{ "Event": { "published": true, "date": "2021-08-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-16", "timestamp": 1629158582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8659b3dc-0d19-4f51-b11e-13ebfaddb3d0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606c9a27-fed9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629149514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149514, "uuid": "d8a92074-bf50-43f2-9df7-f593695edfd0", "comment": "Malware payload (Dridex)", "value": "67ebf24549f30ed1dcee397ce0ac1842", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149514, "uuid": "fdc65a8d-d46c-49e0-bfb1-f519bb32ea92", "comment": "Malware payload (Dridex)", "value": "0173054eee308aeb42e6ed04ca09adad125421fc18d8911cbd58fe9ad5362e72", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149514, "uuid": "16b3f1dc-f2e6-4ef8-80b7-91ba0071cc1b", "comment": "Malware payload (Dridex)", "value": "664b800645f05f0a8b0fa58ea030ee1559bea771", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149514, "uuid": "3b1c25ee-0398-432a-a3e4-7ab64e842cad", "comment": "Malware payload (Dridex)", "value": "7588d59c8078b01246d156bb916931854223da32e9196b103bf04626a4510395fa0207254b90a94d398da8093db1f399", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149514, "uuid": "353d06e7-9bcf-4593-9b76-bf83e1e7834c", "value": "T1BB3402028172E159EA9BC0399C9B5FFB53B44D6F12A12A93F6E5E11CAE19DC211B018F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149514, "uuid": "fac075d3-758a-4a20-91cc-b07a197c7c03", "value": "6144:SXNSLcq+YXEs2EzmVhvhTfeZriB/hOEJ1WYGv6f:yPYXEsqVh1WZOB/hO/YU6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629149514, "uuid": "a84f315e-1308-47f7-965a-b27fd0bf9508", "value": 249686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629149514, "uuid": "5318a4ca-c4fa-4558-b013-5838d5757eab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149514, "uuid": "6160f9bc-27ca-4239-af21-38375eb9338c", "value": "taxve_24224732_20210816_8623822081_4904246403.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec8ef8a-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629105058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105058, "uuid": "20072ffe-1b37-4ad5-9156-9f9ba7da6bec", "comment": "Malware payload (Smoke Loader)", "value": "6fe5bd5873aaaeb6ac65b0c36857e51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105058, "uuid": "f974b9e3-01cd-4749-b0c0-4e444cfa8518", "comment": "Malware payload (Smoke Loader)", "value": "0192b858039b3182dfd17ce582c9398dc1495566082de0f6a76279585bacf8e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105058, "uuid": "80de9262-b352-4173-a8da-847059b15a34", "comment": "Malware payload (Smoke Loader)", "value": "0c2ee10d505b91e60bea89fb5bb8ba54768fec1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105058, "uuid": "f1245677-264c-417b-b403-053714ef97c8", "comment": "Malware payload (Smoke Loader)", "value": "ff568087729bc6023206835c4a6257c8d7e959310ee331e09da3549ec128f6e21e2fe16f38155d0c97d714cf329a6008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105058, "uuid": "7d91566e-2b06-40ca-9604-83a413f9e3d6", "value": "T12504C01D748FC471C351703048BBCFAC5A68AF21D6570A7B27982E6E5F30EB1966B34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105058, "uuid": "372c7f48-13e5-48ae-b814-897cb40e0349", "value": "b6eb307a53194f1a2629d22afffc5564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105058, "uuid": "95268fae-f0ef-4db6-8bba-89fe60d34924", "value": "3072:sLEh+DeIWNa9VKMhcojiIBNzMRIc/mqvUcXZ7yz:sLAYnKkcoOwJc/mqc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629105058, "uuid": "ef5f9c88-e297-4c03-b964-93065507d469", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629105058, "uuid": "52188122-cf3d-4260-8b50-d2a06d6a3c2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105058, "uuid": "47b24bb8-32dd-40fa-a5d0-e9c0271d9d2c", "value": "6fe5bd5873aaaeb6ac65b0c36857e51d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d726ce-fec6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629141493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141493, "uuid": "30b50e11-2d5b-4799-bd64-916a467feb4a", "comment": "Malware payload (Dridex)", "value": "5e58ffb50184c115f7ab875ff6e968c0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141493, "uuid": "72f0e0be-5746-4fe6-9537-5feaba300816", "comment": "Malware payload (Dridex)", "value": "02fbd75ee0d511b08043fa39e9cecc6b1d9587961168fbbfd03222b218afd04e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141493, "uuid": "3f5bd810-a10b-4b92-be16-d6da874dfaa8", "comment": "Malware payload (Dridex)", "value": "14240468f8ca07ef6af01288997d19b2419000db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141493, "uuid": "850507c1-0483-4d60-972b-ecdcbc7d4ca0", "comment": "Malware payload (Dridex)", "value": "eb3033cf92b9615887e7c14b5eabac848f370d904e23e4f953980a7f33d0aa9159022346b5930f66d5811afeaf7dc005", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141493, "uuid": "7d7c596d-3b7d-4b0f-ade6-bd16b544d966", "value": "T1094412094273D254FB6BE0785C9A0FD917FA8F5B01D06B06FAE1E05D6D0EDE7629028B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141493, "uuid": "61784650-53ea-426b-9a7d-646daa5c8c9b", "value": "6144:SANSLcq+YXEsU88pjk6u1F9EpJo6VDdYrAprazeyxD:VPYXEsU8nv1FCpJoihKXyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629141493, "uuid": "0517b281-9b62-46cc-a0a0-46a32324c5b8", "value": 264769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629141493, "uuid": "e93c47b7-945a-4f58-afb3-9f886d106ba4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141493, "uuid": "894388c2-5776-4cea-87a8-7134654f495c", "value": "taxve_96681422_20210816_34443_31787.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86e4834-fe86-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629114121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114121, "uuid": "d40c59fb-9ad0-4c7f-a5a7-9fa6c350db6d", "comment": "Malware payload (RedLineStealer)", "value": "93b71fada8f1a1d612ba00c5e32d76b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114121, "uuid": "f85a5a35-7351-49d9-9bd7-1343d4423602", "comment": "Malware payload (RedLineStealer)", "value": "03eb4a70bc788ed9cd096d77502ef2f5788e4f3930c3bf5924cead278dc6872d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114121, "uuid": "4e7bc21d-07d5-4ea7-90a7-3ee8ebbb2ce2", "comment": "Malware payload (RedLineStealer)", "value": "0f266bdf3bac483c161d3299af79c8471aae23b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114121, "uuid": "c0d1b5a5-eabd-4e4e-9b7c-cf29cbcde267", "comment": "Malware payload (RedLineStealer)", "value": "0ca96474554e86c7ebdec4c0e569c3d03afbfb8a4cfb0f3f579a9e83d16fe8e97fbd348d992d1384227e9f9230c34237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114121, "uuid": "977f6fd8-ebde-41fa-bbff-178fee47bca8", "value": "T19134B04976B6805DBD284F2489F23F7B1D2FFF729912129DC19C1622C079E9A4C42EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114121, "uuid": "a107c734-21e1-4cc2-ab1b-486850d44332", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114121, "uuid": "82d74142-4d86-46d7-9830-37dc17fdaa64", "value": "6144:F5C3seTJlV4ggGT8HXoRKnvVoMQr0ucC6:PSTPC/XomVoMQr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114121, "uuid": "24785ec7-467b-4acd-bd3d-54a65d337de1", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114121, "uuid": "955c7b3c-4ff2-41d4-9eed-7655d5e2a3f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114121, "uuid": "f2ec67b2-a707-47cd-aa59-878a91b8d13d", "value": "93b71fada8f1a1d612ba00c5e32d76b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00465dbe-fec6-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629141192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141192, "uuid": "cc62f2f3-d377-4a52-be1f-f9a1c90f08f6", "comment": "Malware payload", "value": "932c72522c6ec3d2a1d8780d98a934df", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141192, "uuid": "7245cd7e-6a86-44eb-ba46-d5d57cce1dad", "comment": "Malware payload", "value": "04815de6b97b42726be71061fb5dd0ed9f8e5dbd750358f3a01a39e72187933e", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141192, "uuid": "3e66f97c-cb0f-4e68-b957-2a191646da39", "comment": "Malware payload", "value": "fced3d2c58b0eb7c80a3f63802f02015617afa85", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141192, "uuid": "c7e447bd-b2ac-4805-ace6-1af653a672ec", "comment": "Malware payload", "value": "3ead3086ca8d7d7f6b9623783b480ebfd1b3f290793f2bb3119237341982be331aac1d134cb3ecf2432bf772e65841ca", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141192, "uuid": "ef49ac8c-81cf-4386-bfd7-f5ab9ecb4bb1", "value": "T13D548C0573CB867BD9DE07336F4BC7A29A72FC748066C11B4299760E2CF5189E2636E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141192, "uuid": "90383921-1f38-42cc-b5a3-6473d0f139a6", "value": "3072:Z3ygYXkj7q0vTYDryO1nT2U6ij4qpXqnnDibAJBVkF9nY5At+3DJLCA4h:Z5i32Tqp4nwEOY5At+3DJLCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629141192, "uuid": "601023b7-2f0a-401c-b5c3-2d6afaceed98", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629141192, "uuid": "5fdd3c84-40de-4a06-b628-2dac36b752cf", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141192, "uuid": "f710ec34-9904-476b-ab10-fe8c5fa7e810", "value": "Informe-NF.e.VLRZXSVZVYDQNIJMNKOPHDIHPNYWTY_.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f4f32e-fea4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629126684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126684, "uuid": "112a2a79-e2eb-43e6-8de8-affbad84eb00", "comment": "Malware payload (Loki)", "value": "ad92825e2bc4dc8a0402385e1fa515e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126684, "uuid": "46a82670-d777-4762-9f20-a449065989a2", "comment": "Malware payload (Loki)", "value": "04890f9df740295564e37e6a458fc43f1e9ac7d5a038514cf25510474356b4a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126684, "uuid": "221ff9c5-add6-4b8a-a68c-bac2190feb54", "comment": "Malware payload (Loki)", "value": "8856b18cd5b5c597625c6a4197c764994fe6881d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126684, "uuid": "7eb2bf61-31df-4229-b9c6-ea30f303810c", "comment": "Malware payload (Loki)", "value": "c91eee1f155cb8b467c8b6b98a00cc06af4dbd10b93480bca0ce80692fb8483e1c73f599abf885964216bf40ffc79d87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126684, "uuid": "c3f513d5-0fc9-4a70-83a8-a1f9c541118a", "value": "T19845E63915783B37E079D336EAE44413F2E4E85BB220DD596CDA23AB0652F5274D322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126684, "uuid": "0c6b0375-bb86-4cd7-88b2-462e7fbb1d07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126684, "uuid": "73fb722d-524c-4eb8-9a66-075d551d7d19", "value": "24576:tdkblhBJO62Woxe3PNTa631TPHHD89w05o:td41s62WeOTHjOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126684, "uuid": "b21e47d1-d865-40fe-9313-818700006c82", "value": 1219072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126684, "uuid": "79caccfa-8535-4542-b51c-c767d2ae86e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126684, "uuid": "e844f870-cca5-4a7b-a8ee-23733a50e767", "value": "PL0000000BONO-SWIFT.pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d0f6d9-fe86-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629113719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113719, "uuid": "9a99f799-fd4a-4f44-9b5b-a33fb68964d4", "comment": "Malware payload (DanaBot)", "value": "c2b5ba221f158dfebfb2e05b3939c3d0", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113719, "uuid": "da246471-5ce6-40fd-a18e-671b267585d4", "comment": "Malware payload (DanaBot)", "value": "051dfa313f36c762c3d135b7a75eef16099c54eb5ec8e19ad6e0684ee7c5db77", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113719, "uuid": "a1809536-f41a-46bd-ae68-ce0c1ff94577", "comment": "Malware payload (DanaBot)", "value": "766322c33d7a2d00e973146f08b8eb71da8e39ab", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113719, "uuid": "2606ded5-a2ba-43ac-8641-40db532bf374", "comment": "Malware payload (DanaBot)", "value": "6b0cdff7a5b2bed5c0b1580896141d8ee068eb5ef8daf5f8131c8c4a65c8c086826478b5cc875cf912d22dace09fa4af", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113719, "uuid": "164ba2bb-2fbf-4a5d-8c54-37a1dd583b91", "value": "T14735233ED19F9532C78B70B50073D7AC26B4BB00D26B067B13A6A37F4A70D7596263A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113719, "uuid": "74c86041-33e2-478b-ae9e-d28f5ce99e64", "value": "894d0e2453b674d7fa4cc3ff89ddc063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113719, "uuid": "4e86f381-f2ee-4734-acbc-dc1e0be97f33", "value": "24576:9ajm0QfVrcHonLYuFT/jc+JMOykVCUf/7WJxFuBdMNIlDD:4jOrDYy/jJJP7fTWJxkMNIlDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629113719, "uuid": "dc9c92e4-3f1b-4b9a-bf18-bc81b1ad377e", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629113719, "uuid": "09f27342-3c19-416c-b17c-3d17bb4b12b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113719, "uuid": "75298537-1d22-4100-a4f8-420c72c8fdb0", "value": "c2b5ba221f158dfebfb2e05b3939c3d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712ff6ab-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629132362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132362, "uuid": "c1fc7986-bd10-4241-b355-ef8c9c704b70", "comment": "Malware payload (Dridex)", "value": "09e58cee9a2db66d94b83c2f42d53fd5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132362, "uuid": "166438e6-ee10-4835-ae8a-7085aa4905a7", "comment": "Malware payload (Dridex)", "value": "05e07635c0d25af73bb38d42a6bf6e53b0a39e35b87bdaeb971a2c25cef2def5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132362, "uuid": "ff9601a2-08f0-4365-bd40-257615106b60", "comment": "Malware payload (Dridex)", "value": "80e78c7d8e747e62c42450ddf6604df9009ffbab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132362, "uuid": "992f61bb-b500-4430-9f64-68700d7ad5e9", "comment": "Malware payload (Dridex)", "value": "a73c2a6b73c34737169745a20dd34ffc46acc280c5c3767f851474e9c924e1bf372715c0db33983f27293ab0ee5e1618", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132362, "uuid": "35771494-8735-4eb4-9258-e2ca6782fc9a", "value": "T1D844F0812953E91CEE5F7CBD8CCF2AB16F8ACC9E15003D7F64B0A64CE6D03916D68586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132362, "uuid": "cb75f6d5-7f16-40ed-9cd7-dbc75dd5cdfe", "value": "6144:SztZbAPPimNA/kjoitkE8AgmRgeJrJ6iafVH:ytZbAPDNAcM08AJRflJ6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132362, "uuid": "a67107ea-3264-4151-bab7-63749568aa50", "value": 254396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132362, "uuid": "0ca8e729-4f9c-4279-9cf4-e79bb456471e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132362, "uuid": "ccf47028-752c-40f9-9ec4-1e875a8c644e", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_8_30267.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a4abce-fea6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629127675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127675, "uuid": "03d27b98-5173-4c62-b120-53a1e9b27344", "comment": "Malware payload (Dridex)", "value": "b7822ebc4c140c0b96663b63680945a4", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127675, "uuid": "3dea6fa6-b9a4-4d7a-a5c5-03f32f19f0a4", "comment": "Malware payload (Dridex)", "value": "060cee5357ed6f807e908dffd3ede82d8f1403571e92b6d7db468f2803a3ba10", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127675, "uuid": "c494f39a-5b64-4b0a-b69e-dc9552c41f33", "comment": "Malware payload (Dridex)", "value": "8299e072939cdc3acf831473bc45e67f17d252a7", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127675, "uuid": "65717844-8aa1-49ec-9192-a97e07f38af6", "comment": "Malware payload (Dridex)", "value": "129ecc0d54643b89900349b3adef416e4fc41b94758c8dccb19803292963a778603bea58b84aa2c14d1b7ba774708b8a", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127675, "uuid": "89c29bba-093d-48fb-98e8-c482c748e9d6", "value": "T1D3640286AAB7F91CFD8FBD7D4CDE20B46F88DC6B1500696F20F0660CE8E42E51D66025", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127675, "uuid": "6443cf77-a11e-4adc-9ad4-7f112b6a2a0b", "value": "6144:SXtZbAPPimNA/kjoitkb8g40BPZGWC+qYjNwI96eJVlmUh6qe+uFC:qtZbAPDNAcMAH0BPjC8NwI9PmUpNIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629127675, "uuid": "ea8b4f55-64a2-488f-bff5-62b668a281bf", "value": 327668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629127675, "uuid": "e5e7f023-535e-4e25-b539-82ef385542b5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127675, "uuid": "d838bdd1-d0ea-4821-9a6c-251fdc1a7d16", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_6_7324034.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faeb69b5-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629105105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105105, "uuid": "84fc3a32-b92b-446b-b24a-57ba2f343c32", "comment": "Malware payload (ArkeiStealer)", "value": "1bd444fd6de852a41c62d631ea32693d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105105, "uuid": "def47770-a882-439a-95a1-f0c6e4e64532", "comment": "Malware payload (ArkeiStealer)", "value": "076fba2a85bce2280461b292c72769be959e9140497e61a7d0558b57ecd361d5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105105, "uuid": "dac9f2d3-07c9-45ce-b3a0-a0f1ae799e53", "comment": "Malware payload (ArkeiStealer)", "value": "40becb3fefee6538797d67a616a68823c804b376", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105105, "uuid": "80ce43bf-5c83-4ed5-8ca6-b9817e4a9c07", "comment": "Malware payload (ArkeiStealer)", "value": "f92e829f546e826e145e11ef3f95d5309edfbe3a1e660564d33f9e23b668bab1ff5626216601144a490d9253e47147d9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105105, "uuid": "da5850d1-5f7d-4c78-9901-fa6530a60e83", "value": "T1BAB4120575938673D786B435C4B38B8C0A356B62E677648B3B583BAB5F303E0AB36315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105105, "uuid": "770f6ee8-12d7-467f-a3d1-07631ca3081c", "value": "cd5c28f44b3cca36a31a3422b8479df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105105, "uuid": "a86b92f5-985d-4cff-975b-46c638cd6073", "value": "12288:nNyJR/lkOkMAg2E8b8ERfCGH3lgSa8FBu1890KoRa3D:s3TkrHbAAXlXPwavoRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629105105, "uuid": "5ba30fe9-ab57-4b5c-b465-c63c5493a7cf", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629105105, "uuid": "145c3df3-c486-4fac-afbb-584ffb982316", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105105, "uuid": "48713ad8-4684-400c-bb3e-04cda934b592", "value": "1bd444fd6de852a41c62d631ea32693d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d824708-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629134128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134128, "uuid": "d4758581-092c-4833-b74a-12b1c6366a2f", "comment": "Malware payload (AsyncRAT)", "value": "e0af07cb76102ee5401746b282d6ffe5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134128, "uuid": "d859009b-8374-4cf8-8b28-f43ad68e29fe", "comment": "Malware payload (AsyncRAT)", "value": "081d4cc20e46574bc49b49558940371ce6b0a037d61ee2915e3a16f588de4eb8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134128, "uuid": "a78a2c73-1079-4ebe-9741-25fe75752cf1", "comment": "Malware payload (AsyncRAT)", "value": "e150c1788efff84c1290cfece7868ba441a80c3b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134128, "uuid": "2ae6cec3-972d-48b4-8b5b-c2431c5af706", "comment": "Malware payload (AsyncRAT)", "value": "9f5b65403a1ead27f20d919057673f1c32fa4c4dc03dd672e9cf000bdefc055dc33efbeb666c7c808f0f0b1ebacb3664", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134128, "uuid": "5dcf347d-3b72-415f-90bd-c0ec3772cc1e", "value": "T14384220AAE086D6ACF6FDD7714EA4E0043A09D4E5176E1DAFE8A759B2CF3B40311847D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134128, "uuid": "16b121f3-2eab-4a4c-bc06-65f2ba3a8cae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134128, "uuid": "1a837950-4774-428d-aa07-7a21deffebf4", "value": "6144:XOAdR7tUyAiMvrzwjbaKnGP3b0HBqyr1Q0pB/f+yIIB7SOR3DHQKDuXr6SE:+AdR5lAiMDcDGP3b0HzYyI+3EbHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134128, "uuid": "e1d28cd0-08c1-4b29-8eff-430f077699e6", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134128, "uuid": "709f2c21-0c46-4f81-9219-35a366eb6b34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134128, "uuid": "ee9a2cb0-f61b-4e1e-9169-e0d98133d998", "value": "e0af07cb76102ee5401746b282d6ffe5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4cff75-fee3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629153936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153936, "uuid": "66984f3e-822c-4be2-bd2d-84f13f41ba7a", "comment": "Malware payload (Dridex)", "value": "dcafec06b4049709b5a071ab1713403d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153936, "uuid": "f82efa32-31e2-45ca-8bdd-3a8051e402c8", "comment": "Malware payload (Dridex)", "value": "0855cd74e884be5677c70995e68104b360b64c255b0e32085f7052c493699e6d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153936, "uuid": "41cfb060-959c-4c54-922c-234d4d47b0d6", "comment": "Malware payload (Dridex)", "value": "c67da59eb0ebcff4e3156f9614430b06d5d25915", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153936, "uuid": "1590368b-57ad-400c-890b-20e1472ea21e", "comment": "Malware payload (Dridex)", "value": "d5c44dc6371c137b8596506f367d6b5bb02798b50db7dae3bf72ecaf581376de544582462065c9d5acf1b02e8df9e1b4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153936, "uuid": "ab1c4a8e-beef-4647-bbfb-cf453c0ecdcf", "value": "T1C764024A5973F85CEE5FBD798C9F24B42FDCEC6A1300482F20E5A449EED43B66D1604A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153936, "uuid": "4c69429a-80dc-4c0a-adf6-bd27d8fa6af1", "value": "6144:S2tZbAPPimNA/kjoitk/XylaKahUJVi+hhGtSYXipDpcz/mFU1Dhku:vtZbAPDNAcMKasVi+vHYXYpcjma1Dhku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629153936, "uuid": "20ee6eb3-f365-483a-85e3-d81c93b3218d", "value": 332280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629153936, "uuid": "e0179453-ef24-41fd-824f-f7f5917eb8e4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153936, "uuid": "42ff32f8-7230-4a1f-bc53-40719e683fd2", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_8_89729.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af23405-fe84-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629112944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112944, "uuid": "66306e89-677a-4274-b04d-eacea49d58ea", "comment": "Malware payload (Formbook)", "value": "376b4ec91fc3fb35e98c46435116eccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112944, "uuid": "7f1763f3-7441-4a95-981d-6f5119909489", "comment": "Malware payload (Formbook)", "value": "0879dee35833049ac723a101661d8f5a4bb92528b98fa27fc564a44649161862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112944, "uuid": "7b9b7e30-3f31-49bc-94fb-e3dd3d2308b5", "comment": "Malware payload (Formbook)", "value": "de7dad010ec5114b57bcdd87a0795ad8060ff103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112944, "uuid": "69fa7230-14b5-4f9d-bcea-00e15177cba9", "comment": "Malware payload (Formbook)", "value": "34ff0f2d92185d6957267078b317d214e52f77c3d58837b5d186c5f266e4164ea2b74b0c9f0e3c1115ae581cb6cf15a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112944, "uuid": "7927f539-e3a3-49d9-bf3b-bff5661783b4", "value": "T10E64DFA2965769A5C8BED239C049493F03E3DA7EE2A2C2CA3B5707C07D1C1636CF55C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112944, "uuid": "8cbc9799-6c56-4a0f-85fa-6dccc302ecbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112944, "uuid": "4fcd2c94-15af-427a-b0e8-ed7d589a4423", "value": "6144:JZMfrlhhbobE3TWKZHgtcfQhzmhLE8E9OQ1qoYm:JZgwbUWWg2omhLE8E9/wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629112944, "uuid": "5a6c22af-a98e-4b95-a097-c38628d25d79", "value": 331632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629112944, "uuid": "8baae3a9-d203-4df1-ba99-e704a235a3c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112944, "uuid": "8fcb3737-90da-40f5-8bb5-b702c60519e2", "value": "ORDER PROPOSAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe402ee-fecc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629143822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143822, "uuid": "949ac72c-78fe-4bd6-8894-43f8acc5bc02", "comment": "Malware payload (Dridex)", "value": "f40677fe80c70a0da3c82551f4d50975", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143822, "uuid": "2881a92a-8a03-47cd-8f66-a30f48ed4753", "comment": "Malware payload (Dridex)", "value": "09753ca26c16d72baa835820208eb7d284b893cf9b1ff17cd8c9a9f462c21a0e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143822, "uuid": "365cf974-dc52-4737-8a51-87279eb64ab8", "comment": "Malware payload (Dridex)", "value": "74090eb4d2b94d4e271ce8739e9c8e35868ed154", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143822, "uuid": "6fbc3a56-8dc6-44c7-a9e9-39bb438ded57", "comment": "Malware payload (Dridex)", "value": "39553b6c91ff5f16b6e2893ca540b720089b4fe06c7cd191206aef5f4b061c8de616d8d4366ba55683a9a56c67402d02", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143822, "uuid": "62d53331-5a83-49f0-b9df-f6acc377e9c1", "value": "T1DC3401158572F274E69B60BE4D9D0FE637B19E6F41D02707FAE4E61CAE0ACE32191087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143822, "uuid": "311272f7-0c9c-489b-a0f0-1cfa72394ebf", "value": "6144:StNSLcq+YXEs52f7l5YmuueHRgGm7+fZ8H1G:SPYXEsAfb3mhmSR8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629143822, "uuid": "bea64733-75bc-4e3d-bcb1-9444464d76a0", "value": 243633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629143822, "uuid": "e0703124-bf0a-48db-b1c9-078be4f536c1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143822, "uuid": "99fc5017-9ba6-4720-b1d5-91ece97b575c", "value": "taxve_848156024_20210816_0984003123_20918637.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b94bc6f-fece-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629144674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144674, "uuid": "be09ea9f-37cc-4920-b5f7-3eb729f6d405", "comment": "Malware payload (Dridex)", "value": "495536ee44dea1ec9519e8fe3fcdfbb7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144674, "uuid": "ce6b44fc-253f-4511-853f-34848af639fa", "comment": "Malware payload (Dridex)", "value": "099ca6a6417f69fec427cb17c33463bc6b46267a526b9b1f26cab2892e580919", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144674, "uuid": "6f9b7fa9-e715-4a9a-8dbd-a2aa81e72d1a", "comment": "Malware payload (Dridex)", "value": "6778039b34fc414f7ba9fc0b0fe9c458a2b94f2b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144674, "uuid": "8eb3d2fb-a284-400f-8c65-05fae41d9991", "comment": "Malware payload (Dridex)", "value": "aee9731b69fe1c455fefb5f103783337f577ae66e08bde4ae7b629a956364f4c6eb7592c53512609d269d1982b1cb378", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144674, "uuid": "e51a0af1-16dc-4a8f-a139-7e5fed4142d0", "value": "T1C56402487DA3F55CFE4FBE788C9F29B06F99DDD80100596F21A6A11CEAD03E20E550A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144674, "uuid": "4788df26-fde0-4d35-a1a7-3b49490c76e6", "value": "6144:SNtZbAPPimNA/kjoitkGPIhptE3p7ddv9yRIFDODJ+W2MfhLgZUdrFwrg:8tZbAPDNAcMK1BnvgRMDOYW2MfNA6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629144674, "uuid": "b581aea6-d911-4fed-899b-c0736d7f8910", "value": 326703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629144674, "uuid": "e924e1e3-77f8-480f-a173-91c8ea730fea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144674, "uuid": "19cf167b-975b-401f-9601-e53497c600c5", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_6_29459947.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b09e508-fece-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629144888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144888, "uuid": "a830f8ff-115a-440c-8325-65b6c2f681f6", "comment": "Malware payload (Dridex)", "value": "16c5e09b2a017c455b4c681f8d9b7352", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144888, "uuid": "856a53de-722e-4006-b0d2-79d44bc4517f", "comment": "Malware payload (Dridex)", "value": "0a393f396f87a892009b0800573494b24bfc1f7f236ec1bc0068664be31c57fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144888, "uuid": "7e994c77-1371-4ab9-bef8-8f1abf9ca470", "comment": "Malware payload (Dridex)", "value": "f9ab371ecb206688f6b4861f3c52d0b4af1f6a63", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144888, "uuid": "5ee49ca9-4138-42b5-bd70-47d9a6337766", "comment": "Malware payload (Dridex)", "value": "b0ebf8430f1b062f9489a11a7826ffd641d4c06d1181d65b86b7772c7448dc4f554cc36d4bdc2dfb0467653bfce6a2d8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144888, "uuid": "911ade2a-62f1-454f-b8b5-438c1889b097", "value": "T1D56401562843F1ACEE5F6E398CEE28796FC9CDAA15002A7F31F2A12DE6D07D15C44186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144888, "uuid": "2ec96885-7a1e-4180-9d38-df5a97fbaa08", "value": "6144:STtZbAPPimNA/kjoitkjlzg8Ocplz56R8JO5WEJzFGTHbWSsNN5LSNS:GtZbAPDNAcMpzaUV6RuO5bFGTHb72NVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629144888, "uuid": "89739d3e-13af-40e5-863e-9e111612f609", "value": 328405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629144888, "uuid": "3e8f6363-9fc9-4e0c-8105-f0669a34972f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144888, "uuid": "a14c8358-edda-4c17-ba89-a9fdd07c0485", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_583772.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36143f46-fec6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629141282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141282, "uuid": "7213d603-a516-402e-931e-f4f753fb5f0f", "comment": "Malware payload (Dridex)", "value": "775031af2c69ff434c74fbb29fee9ed8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141282, "uuid": "eac8adb3-04e4-449e-a8c3-6ea31aa0e261", "comment": "Malware payload (Dridex)", "value": "0ad67a4276b2df60e0cfd2183844d966758bddb8de9deac4c06b19c48fe4d9f9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141282, "uuid": "4f0022f4-b23c-4f4c-a051-d90f180f5479", "comment": "Malware payload (Dridex)", "value": "d5cbe31d17fc1fc2477be6b71d47b0cad8ae8a65", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141282, "uuid": "829c2c04-f4c0-4fdd-a458-25cedf59a292", "comment": "Malware payload (Dridex)", "value": "530fe681d80751df31c66fae12f2e0123e36614e8e1f6ee74ff81bb0f068ca27d2746acb214db9e45abf1a0224ba31f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141282, "uuid": "82eab1a2-4e5f-4891-b870-a2b3239c26c1", "value": "T1DE64020AC4B7F090DEDA60764D4B1FEA3BB5AE2F21909B4A61E2615FDF0CDD3165204B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141282, "uuid": "8da7ed22-6589-4281-a6ac-7ba082e4fda3", "value": "6144:SFNSLcq+YXEs1oqipNerhkbuah10tpfVKZQU3fzhxOwFp8:cPYXEs13YeOF2aNPzre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629141282, "uuid": "a506a3c9-0041-484e-a454-7e95818bdc04", "value": 306729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629141282, "uuid": "c9b9332a-baa2-474a-9faf-04b6c1b99472", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141282, "uuid": "d26548e3-8674-46d9-bd0e-4b22feafbf37", "value": "taxve_88492620_20210816_911721564_184218946.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96995596-fea6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629127700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127700, "uuid": "0d4a997f-303b-4465-97a0-1d1421623009", "comment": "Malware payload (Dridex)", "value": "271b9aa2476aca33609c50c52ae89af2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127700, "uuid": "4df23503-fc15-44f8-a37c-e1cdeb8fd6ef", "comment": "Malware payload (Dridex)", "value": "0b421b87c36302cbad0135de0e6e6f4ff8968e3d2d4ea9d5bda1462d8ef14e49", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127700, "uuid": "91a8bb74-5fc3-4d18-a82f-7f6ed9ebe58f", "comment": "Malware payload (Dridex)", "value": "c16c72b53a97fd5685e27ecb0a7adb5f64f8c9a2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127700, "uuid": "077a8e54-9ab4-434a-964b-36a179d76e03", "comment": "Malware payload (Dridex)", "value": "838e4600aa2a7ab7848fa72290a517c8b8ac2242f2cd006997ed8db9782c3da13f332255e6447ea70dbc95f8a31e1648", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127700, "uuid": "f4dcf2fc-717d-4d03-a29d-8d67f9f5505a", "value": "T15364F1156563E4ADEF5FAD3C8C8F11B0BF85DDBE56002D2F61A1B22CE6C13C1AC66285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127700, "uuid": "d0210cfe-5800-49ad-9e5a-ef5230cd7878", "value": "6144:STtZbAPPimNA/kjoitkGchiByRwhMOSTTcoKf6nhYYMfxg3wmhE0qf:otZbAPDNAcM2coByRwMOSTwNf6nhYYMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629127700, "uuid": "06c4cd95-a6b0-4980-a9d1-b09e14d02b77", "value": 328090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629127700, "uuid": "ef7a4467-4b61-4fb2-9cbe-a7d2fbb90d00", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127700, "uuid": "5f49b3df-5ef9-41be-99d5-a8ec7b68bd76", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_1_5179168865.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396c99d2-fe9f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629124538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124538, "uuid": "c56a821b-0d42-4837-925f-f3921d032d25", "comment": "Malware payload", "value": "a3fd871b160b5edeff12ca9f4cd7c9c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124538, "uuid": "3521f2e8-f29d-4185-8c5b-786e3b46f42c", "comment": "Malware payload", "value": "0b9390f9faaaf492ac43c6bf1d31662006257a9beeb396c4ee4748ac1f4d70f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124538, "uuid": "0d9bb504-f664-4821-a015-89b1319429be", "comment": "Malware payload", "value": "fbbc19eb6a9872b21794c66baa6111e4499d18dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124538, "uuid": "e28b8f66-0927-4345-983b-d7687461f541", "comment": "Malware payload", "value": "0e1596100dffbe5070cf7b18d23fa6c7167bb5109b880832c9af57dc50dd19a3e855d3415b979da5305840f2279048de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124538, "uuid": "88270a72-0be1-423c-aa92-1f87719b4ff6", "value": "T14195E0B10519EF22F8B306B97872564842B48D56C56BCB69FE7332ABCD70FC23456B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124538, "uuid": "cddbb35b-c045-4813-9ce3-863aee82efe4", "value": "49152:WhZUoHMjmCm6Ud+zyXc6dnS3vt05IVqCVhT6DDtN:WhZUosjmCmN+mRnI+m6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629124538, "uuid": "f4cbf3d3-02fe-48ac-bf4b-9857362f5733", "value": 1958400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629124538, "uuid": "6be864d8-f242-4f0c-84ce-6019dc9b3cec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124538, "uuid": "c8c694c9-3aff-42f6-a58e-2280a6232036", "value": "a3fd871b160b5edeff12ca9f4cd7c9c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efad09fc-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629114536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114536, "uuid": "00a215d4-8b85-472e-915b-211b9c6c6b8a", "comment": "Malware payload (DanaBot)", "value": "d422e8d608753eb651459dee410ec828", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114536, "uuid": "0b4d788c-66db-4de2-a0ce-6e51119e8733", "comment": "Malware payload (DanaBot)", "value": "0bc3f51852753f7a8744cbd63d4285838f057331017a606f6e5a0b71d7b53bf3", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114536, "uuid": "2868e50d-fc9f-4bda-9216-52408b6129ee", "comment": "Malware payload (DanaBot)", "value": "a68389046f96aa0bad8f7e63cf775bb8ca46e080", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114536, "uuid": "d90e2900-8629-45c8-ac0a-8df6b11a1290", "comment": "Malware payload (DanaBot)", "value": "200e2065037016401589df868341dc7c8e5f54e544a416520ae34f270eb9d830d12d2e095b482e63a7cc6b73c0d85626", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114536, "uuid": "102260df-fbbb-44fd-be55-a576e7c2c56d", "value": "T11A35231D192FE4F5F31234B288775B5C9A721F34EA4359B2170A626B0B7ABB06FD1384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114536, "uuid": "e9ee8057-fe1e-4b93-91aa-5095e8352792", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114536, "uuid": "845ed995-c5b5-49fb-8fda-28bbd5679433", "value": "24576:pAjTn+KqMaQWHbI2OS1qJfYIV5JoLyK4g2St1L/:ATsrr4RYuzo14g2iV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114536, "uuid": "65f89351-f1ab-469f-97b3-a766787bfaf2", "value": 1100800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114536, "uuid": "e1d4f5fc-cee3-47d0-8b6e-b6afe525d192", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114536, "uuid": "382b4801-a0b6-428c-8cf9-c5e0ebfe4098", "value": "d422e8d608753eb651459dee410ec828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad023790-fe81-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629111847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629111847, "uuid": "2bbc673f-4a20-4ae8-8713-6e2ede2a697b", "comment": "Malware payload (Formbook)", "value": "2219442c3227ffa9ada120bb9fe9eb6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629111847, "uuid": "2bc3d37e-ad47-4eb7-a078-1286e8893d15", "comment": "Malware payload (Formbook)", "value": "0cb047df6b7a2df55972c4d33b5d10b511f707f30907513f07bf5ae2c070d534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629111847, "uuid": "e49958ab-46d3-4d92-879e-7f70de963151", "comment": "Malware payload (Formbook)", "value": "f32583503a9b5861c53024b848ec16bf793f9a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629111847, "uuid": "5769d1f8-948e-4717-80eb-97e468e6b410", "comment": "Malware payload (Formbook)", "value": "5a13cdf813d8eabc0f43f5dc5a22621402fd5c4e893ca63994f362044807bb01c128a6f1c22b679e0b541842c108cedb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629111847, "uuid": "21e8e727-e6dd-451c-beb8-3e51e775105b", "value": "T1A745E73916B82B27E079E325E6E54417B3E0A45FB225ED59BCCE07A70206F4265C733E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629111847, "uuid": "24f0be15-538b-4134-92a9-2669f4a7f049", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629111847, "uuid": "bbe288f8-d308-4f93-a2ab-79bf30f8f1d9", "value": "24576:xoDSFYqblhB9Zqia9E7d0h0daaGKujU9ve3haTsD:5yC19ZqbEx0hcHpyhUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629111847, "uuid": "675d11f6-f679-4b33-97c9-d5751b514f8e", "value": 1181696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629111847, "uuid": "d1419c54-449d-48d5-bee7-73810cfb8dcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629111847, "uuid": "213df997-70bd-464b-b4bc-f40ddf4f5aa0", "value": "Pending DHL Shipment Notification REF 81621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0bbadf-fec8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629142126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142126, "uuid": "5ae0bd50-c9e3-4f3b-89b9-c29413f65bfc", "comment": "Malware payload (Dridex)", "value": "42ad80007a77fdea4d1540e835690e20", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142126, "uuid": "256136b1-3538-4a28-9f1f-cfc2c9e0daaa", "comment": "Malware payload (Dridex)", "value": "0e9e4bfbbeeb52f3fd180edb57a32fa214cd112d44e5acb7aa5e25b4fbc9a36b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142126, "uuid": "f67211a5-b288-4b23-8cc6-d3cdb533b044", "comment": "Malware payload (Dridex)", "value": "fe167abef2eb8be8ab184dcd5b188c8ef0b665b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142126, "uuid": "cb81556f-49ad-4df9-8132-3cd1420bfaf4", "comment": "Malware payload (Dridex)", "value": "c645de39cfd3b1f5d4280a34066e5149e3f3ad91d8591e2b864cb884b15fc0f8c551fc144422a8450d1d2f1db8f8aa44", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142126, "uuid": "a2e305f5-7ae0-4000-bdb7-022c6ab08647", "value": "T19B44F0455963D99CFF8F7C3C5DEE35B46F9DCDBE0800A63F22A0A05CD6E92822D5508A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142126, "uuid": "d2ca8e72-e725-41d4-ac08-4b517c113c7c", "value": "6144:S6tZbAPPimNA/kjoitkeDqveICiq7xqEaKm9577LBtxG1:9tZbAPDNAcMTxCiq1QBnxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629142126, "uuid": "42df38c7-bbf3-4398-bbc6-9ddc994b5b94", "value": 274602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629142126, "uuid": "7124ea04-399b-4727-97b0-98eed703e638", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142126, "uuid": "95d2fc05-5c75-4f91-950f-5d202dc9c22c", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_7_186685.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147c3fb4-fed0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629145521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145521, "uuid": "f6230723-3156-4b9f-8e2b-ea5c3aa66f0e", "comment": "Malware payload (Dridex)", "value": "f96d281618e4a12d3304eda316fcd78f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145521, "uuid": "ed62179c-c3a0-4f11-a7fe-a05634609487", "comment": "Malware payload (Dridex)", "value": "0ef83c93e551f8d1f6e43a2886f24b737b8594d96a84d49af2249074d71e386e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145521, "uuid": "b228a7ca-e11e-4f80-a774-dca7109faed7", "comment": "Malware payload (Dridex)", "value": "cddc339edb26797bbc0b24255f958fdee4ecf7d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145521, "uuid": "ee3aed5b-4142-460a-b506-3b4f0e3d4fdd", "comment": "Malware payload (Dridex)", "value": "e4fdd1df2d9fa211f3117e510703af9fa5d5d7c44fe7ac7c3b95d726fdbc9bb6f19bf13739f62e0b762cfe7fa7e1ad99", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145521, "uuid": "bcf13e44-9e74-464f-912f-fd9aed05c907", "value": "T13C44F1586963E42CFD8F7C7E9C8E25B47F8ACDF90940593F21F1A20CEAE43A55C65086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145521, "uuid": "5160247c-329a-45df-9bc9-ec5f89037a3e", "value": "6144:SJtZbAPPimNA/kjoitkWmvWHD0MqXZDp7By3e2QS:AtZbAPDNAcMGqWjp81D2QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629145521, "uuid": "72b7f636-bb19-4ce0-b669-fda9f037eeea", "value": 254075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629145521, "uuid": "f5d960a7-e3b5-4224-81fc-c976f665ad40", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145521, "uuid": "79505fc0-0e3c-4a09-bed2-4fb16bfd623d", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_3538541474.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c55da7-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629104857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104857, "uuid": "0126b3f4-ae5c-4333-9673-58574d5eb21e", "comment": "Malware payload (Smoke Loader)", "value": "80cf8ea96ab719cc0d60850b59ee66d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104857, "uuid": "6036fd96-fa71-4c06-9db2-841164f53c7b", "comment": "Malware payload (Smoke Loader)", "value": "0ef8e97b174862177771e0f42373530de7356883781cd0c498ac950dd2748835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104857, "uuid": "2a712a95-bfbd-42fd-b2f4-43620ef8a04e", "comment": "Malware payload (Smoke Loader)", "value": "798439890ced66c12051b1f078e2538da1045139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104857, "uuid": "2e879437-66a0-4d15-978e-b4bd928cf81b", "comment": "Malware payload (Smoke Loader)", "value": "9f9ed2809bfdbfa0abe7707cce32ae49c2e6b48f29a64e4600b3abcb28661b37953a9521955df3abb16d07f81e36d814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104857, "uuid": "8b567918-8a35-4548-adec-0e87bcee88b4", "value": "T19004BF1D718FEC72CB9531304077CBAC1A799B21DA53097B279829AF5F30EB07666389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104857, "uuid": "3aa48f7b-39c6-4855-8a55-c2825c6834c4", "value": "b6eb307a53194f1a2629d22afffc5564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104857, "uuid": "12a81a7e-d025-47e0-a5fd-a91d58e0feb8", "value": "3072:3LEh+DjIWOM9TrPqwEhtih1UBNDNR+c/mlHZ7yz:3LhplrlctisAc/ml0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104857, "uuid": "8e52ada2-f6bd-453d-9b43-c1ad62a50f99", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104857, "uuid": "dbb86345-b114-4f9f-896b-d5014065516f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104857, "uuid": "98576312-0a02-4644-905c-bd911abed44a", "value": "80cf8ea96ab719cc0d60850b59ee66d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e54ad0-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629104928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104928, "uuid": "40bdf5e2-a370-4b27-8118-3063a3b8e62a", "comment": "Malware payload (RaccoonStealer)", "value": "46fe1b6dbda10d1a5d753fec69c8f47e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104928, "uuid": "301ffaba-232d-4a46-a840-23936c45f985", "comment": "Malware payload (RaccoonStealer)", "value": "1054705d0d7ac38687f44baf1c5840910c3e9886c2139706dee8eaceeb4a7621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104928, "uuid": "9f347069-1982-45f5-8212-0296d5aee4c2", "comment": "Malware payload (RaccoonStealer)", "value": "b5931dbe6f2a7de710fea1fab199fb96a1e633c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104928, "uuid": "d11712bb-f9df-49c6-85c6-77f11ca383c5", "comment": "Malware payload (RaccoonStealer)", "value": "6807e848ac8cb9def3e26a65420311c5fa5e85679934a8c3ae4c09cf24f68edac6b240f6afaba72759383d2a154e8e4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104928, "uuid": "103d66d5-2270-4d82-9ace-0626f8b4a816", "value": "T15504BF1DB58FC472C785743040B3CBAC5A38AF21D643297F3798266E5F70EB0566639A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104928, "uuid": "f85e485e-f6ba-4b45-8edc-893b58abb001", "value": "b6eb307a53194f1a2629d22afffc5564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104928, "uuid": "ed24149e-fb80-42a3-a867-14973c64f423", "value": "3072:YLEh+DeIWNa2XkD2BNzSRvc/m6XujvZ7yz:YLAY2RQc/miuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104928, "uuid": "857e6772-01d1-4c42-bb4f-c090e34dd536", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104928, "uuid": "b75bd8e8-3203-4ca9-bdb3-124f77a47e45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104928, "uuid": "a34415f3-8040-46b1-b5d9-335e95b1e341", "value": "46fe1b6dbda10d1a5d753fec69c8f47e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a28b3c-fee4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629154361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154361, "uuid": "e1cd24e4-8e5c-4152-b1b7-d0c966f3fcec", "comment": "Malware payload (Dridex)", "value": "dd80623b018b1e1e8dbef5422bdc5a8d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154361, "uuid": "c4a8a421-595b-4ba1-87db-37fe6455cfba", "comment": "Malware payload (Dridex)", "value": "11571d3b7bb5610eaa5839653c8a4590aafa510bf2fbda31e9928a459a2ba628", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154361, "uuid": "aa7d58cc-6f8b-4c97-9d1f-2bcf45e17047", "comment": "Malware payload (Dridex)", "value": "6bca18488baf9cfacad3284c6251bc928f6cea66", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154361, "uuid": "086a9c7e-ae5d-43d1-bc3f-f6f216775c97", "comment": "Malware payload (Dridex)", "value": "881af2d4e2f989c46f65f92189b5143e19bb3c3b39a932a0070e29775a2e7652fe47c96bed015544751972fa093238da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154361, "uuid": "80ed7ac6-e7f0-40b5-8eee-d0db95fae263", "value": "T1B044F1152AA7E95CFE8F3D7C8CAD24743F98CCAD0910AA7F11B1A91CEAE03D11C19556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154361, "uuid": "b81b3bb9-3f65-43b5-95e1-342b4e060ae5", "value": "6144:SNtZbAPPimNA/kjoitk2YSzXn+AWQxadV/lGvXz23B2Cjt:8tZbAPDNAcMmY6CQoV/0vX63B24t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629154361, "uuid": "7f7b1061-4dff-46c7-a7c2-baa49d5e79c0", "value": 256733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629154361, "uuid": "b66da5f2-d9b1-45f2-bbbc-d504afc943ad", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154361, "uuid": "1ad5cc2c-b6d8-40ff-aeb0-a4b1028ada8b", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_0879779084.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143f9cce-feeb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629157117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157117, "uuid": "14fd8f3e-bdd1-421c-aab5-46a2041f8fad", "comment": "Malware payload (Dridex)", "value": "a4774e8bc50b664824d02e561dd432e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157117, "uuid": "5d74051c-08b9-42ca-a688-5dc3e16c4539", "comment": "Malware payload (Dridex)", "value": "118e9f5290d92e2a97b22eb836bc5e51028886104ecfb9a6831ae1bf662d69fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157117, "uuid": "10e6986c-a9a4-4ad7-a8f4-4555268e18ee", "comment": "Malware payload (Dridex)", "value": "2719dc5521c5b002d4bc3c13ea7d5ec23f4bc3b3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157117, "uuid": "77c8eed2-2028-480c-8f33-42e899c7cbbd", "comment": "Malware payload (Dridex)", "value": "1138e393580bc52d03b9836294169c428df2d9c58a230794ed7170c2274b9ea36bec2e8c485c1f4fb5ec08ddf8adb9c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157117, "uuid": "6e2ebc3c-ba51-4fcd-bac9-ff7ce2c34e7f", "value": "T19F6402496E27E42CEE4FBC3D8C9F14706F8DCDAD2A40586F10A2916CDAE47E71D2644B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157117, "uuid": "fbe37b1f-536c-4723-bcab-dff32396584c", "value": "6144:STtZbAPPimNA/kjoitk4EUYlYfpzh9QD0nsN1HinS4ea/wJPe:GtZbAPDNAcMtUYkpzh9nns7iS4ea/2Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629157117, "uuid": "bd1d4530-ae5f-4e48-963d-cb67c3839903", "value": 321590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629157117, "uuid": "da72cb07-1800-4019-8148-50cb8c05eafc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157117, "uuid": "870041a4-449e-4f50-90f7-d10a0736b455", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_7_039017685.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e897bfe-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629114158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114158, "uuid": "32509f00-31cc-4659-b8e4-f5fc128cc74d", "comment": "Malware payload (Smoke Loader)", "value": "314db44ee452bd2b8e6628eaf3bd1064", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114158, "uuid": "63e2106c-6fc4-4fb2-84c3-69ca32b13b44", "comment": "Malware payload (Smoke Loader)", "value": "11dac94826216edbae098e770b3b1d7ad541df34f7b80e856d417049890e3800", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114158, "uuid": "c3aa1e00-31a4-44e8-ba2d-8a5f4cf5bfad", "comment": "Malware payload (Smoke Loader)", "value": "1e868f1ed042d51d11021d4c328b6235bee4c79e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114158, "uuid": "ee4ea10d-ea47-4c2a-9327-ce9c8f459aec", "comment": "Malware payload (Smoke Loader)", "value": "e36fe108dbeb312027011860e6c8aa29bdb63f06386b93e7e56af2ee76e4a0e8c3965e095eeb28d8fbb4fd4b70259d00", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114158, "uuid": "6033a420-d903-4f64-8cb4-1ffac39369ed", "value": "T1F904BF1D798FE072C78275340473CBAC3A299F20EA53097B6798256F5F30EF1526639A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114158, "uuid": "5501c3b1-d3fb-433d-b35c-dccb28ee6425", "value": "675f985c31bb43cb925f7664d8fe06b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114158, "uuid": "ab77e93c-892a-40ad-b4b9-f9a41fae2b4a", "value": "3072:JW0LJHWDX7njWyN6bBLYWuBNg6Rgc/mSz0Z7yq:JLirjWy8bvCKc/mO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114158, "uuid": "d61d6583-4c84-4b0d-8800-59b5e2932b51", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114158, "uuid": "dcc8bafc-72fd-46e9-85b4-72e6b83340e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114158, "uuid": "71d635da-ff04-498a-b69d-f4e4849aec39", "value": "314db44ee452bd2b8e6628eaf3bd1064.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d2c4a3-fe5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629096772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096772, "uuid": "20924086-c43c-4be3-b937-2a2adcdf7c1c", "comment": "Malware payload (Formbook)", "value": "54e7b87d45d3c9d699aa7b1d88021932", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096772, "uuid": "0756f9c7-f9d0-4638-a68f-106034afa926", "comment": "Malware payload (Formbook)", "value": "11f64dfaf518dd65b4f850958b957ab0a503f2b54153f53047a9650b18d88150", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096772, "uuid": "33636879-8666-4cb9-a6bb-963a2a5254c7", "comment": "Malware payload (Formbook)", "value": "422a063ad3ea3e387ab0cd6cec0946888fcc02fa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096772, "uuid": "20dfa4af-8cfe-4fad-a236-e768c028424a", "comment": "Malware payload (Formbook)", "value": "4c3377aa72bc4b59b5e8ee069fb869d7fde4ac95e9809cf9787926a34f18e41a453d4a73bd31507de55b33b4ff707da9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096772, "uuid": "4a55b5fe-80bb-4966-978c-d2ef1f1d03e1", "value": "T1E5551209FC462FD3D512997838750528C64FBC89BE26CF0167967F0289FA1E09E63DB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096772, "uuid": "e0b8d480-2935-4d64-b195-0c89609c0e26", "value": "24576:GsNgGgYH0FGz/ToRVYabAkqA2mFRFHu9d67oHZ7hCfStEgpqX1zdtX9MFKA:rNZWGzEKcOj600fStEgpqX1Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629096772, "uuid": "23beefeb-9671-4fb6-932c-07a4cd5bb41f", "value": 1357080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629096772, "uuid": "669325fa-b9a1-44eb-90c6-215a60a2ba7a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096772, "uuid": "342798e4-c6b2-47d8-b29b-e1dd206b06f0", "value": "REQUEST FOR QUOTATION00787MT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec350525-fed6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629148460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148460, "uuid": "0ea38942-3f9f-4e58-8d62-378493cb6d63", "comment": "Malware payload (Dridex)", "value": "370bb1bb7658581ef48ec0151bc2b557", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148460, "uuid": "511e1b87-c568-4445-a03b-ed0edc5d3e6b", "comment": "Malware payload (Dridex)", "value": "1243eccd1687330de0140a9605cb2161b2c844696d33434d0ad2e28db053d821", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148460, "uuid": "419e06c9-649c-4ce5-a56b-3224bd789a07", "comment": "Malware payload (Dridex)", "value": "041e73159f99a34346b97f4f0c09dde4b5287c04", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148460, "uuid": "447d19fb-86aa-4852-83e3-b9b358e65afe", "comment": "Malware payload (Dridex)", "value": "56994a5aec3322a3a94da6729782aff50a8d900868feaad79aee643e198dc673de59fd111128616f28cd2e350857f35d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148460, "uuid": "e139247f-77bc-4b11-976b-55e1f630233b", "value": "T15564024B44B3E124EA8AE0B19C971FFA1BB8DF2B65C05F16B7E2715D9D04DE3434218A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148460, "uuid": "7921c2c7-4f40-4f92-9a68-03e00f4b4ef3", "value": "6144:SHNSLcq+YXEsJpSxEqLViucFih3dN4kMjr6YpXeahPfGB9xJe32jlI:oPYXEsJkJiNwdN4HiY53o9xE32m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629148460, "uuid": "b2d278a8-86e3-4e14-ba6b-af1b0368db6f", "value": 312066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629148460, "uuid": "8327c684-504c-40b3-8ee5-760e8c185440", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148460, "uuid": "ebeab5aa-a3e1-4dea-87dc-0a949c648dc8", "value": "taxve_48122_20210816_6272070_58070.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0c59c6-fe84-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629113055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113055, "uuid": "ef7706bc-41ce-4c6c-9f76-6f61cce0b1ac", "comment": "Malware payload (SnakeKeylogger)", "value": "58dfedfd07f483038b5a9ec74ca4d520", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113055, "uuid": "7230f6cf-43cf-425d-9eab-2fad4a601c87", "comment": "Malware payload (SnakeKeylogger)", "value": "1252ece51a29bff6dcfb78a28d430228b3083b529e2212e17482577e49bba034", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113055, "uuid": "9014f3d8-d440-4524-a8ac-28899dc1381d", "comment": "Malware payload (SnakeKeylogger)", "value": "d134fea4210a897d050884da1477ccc5aefff456", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113055, "uuid": "5dc434df-825a-43ab-8be0-7b2807712160", "comment": "Malware payload (SnakeKeylogger)", "value": "0292b69a2172c098b66e302ac20c9d45a2baacebcb595a5afdccb784bf00b93a6ad003746c6b2044e147432609c4d657", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113055, "uuid": "6953d8f2-c24f-4944-9b05-be28c6a47a23", "value": "T1A5D433DE83FA92035F991F0AAE15137C7257B0B89BBE535A9345DEDC2BC7D480168C06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113055, "uuid": "08bbd983-b5b3-4dc2-b42e-3c58107bb202", "value": "12288:/kWxIZSZXc6toMbvk9u4vhyk+h24L0oT2fkLEdHWAI+Muz2P:9ASZ5Y9ueHK26ioFArze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629113055, "uuid": "e69cea29-da65-4b04-a291-768623155137", "value": 648003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629113055, "uuid": "34d4b19b-0a8e-416d-9768-6831951dd615", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113055, "uuid": "721bf3d0-5cbc-4acd-86e3-0c0d91ce3a16", "value": "Purchase order 4500640396.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec102bd-fe9f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629124708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124708, "uuid": "4a039ee5-a3d1-4fa0-b949-19249fdfc4c4", "comment": "Malware payload (Gozi)", "value": "bbdf9b8b0ffc74923d36f152112d26a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124708, "uuid": "83e1ee0d-c216-4474-a5de-a4af598470d5", "comment": "Malware payload (Gozi)", "value": "12df68c8de00fc68de68ca402d96e7dfe2effab3fb31359fdd3acea5cd390283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124708, "uuid": "fe99b790-6462-4ae3-909e-146bf9a0b206", "comment": "Malware payload (Gozi)", "value": "75649b87458a80f3d8d1eb75f6d68322fd4ceb7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124708, "uuid": "2a09d50d-a826-4a3b-b5f4-d98107600601", "comment": "Malware payload (Gozi)", "value": "650f725697e10734efb8b4d89962ad783def28f4011eb317c2b565c17e3bd52808c65da6c46dc5b0dcc07f4bb7b9b51e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124708, "uuid": "931e47d7-61f2-4959-b086-87965d61e899", "value": "T146244A6AA3E40599ED6BC6B5CE52D61BE7F374092B14D30F4370CAA66F07722B21C352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124708, "uuid": "a3fa08e7-4b3c-4858-bb04-92aa0361d86a", "value": "6144:/HExb7VwvtKNbnvSxYNiyf+D3Lufy5lH:cxb5wvtKRvSxY0G+D7ufo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629124708, "uuid": "8c75781a-db4d-4538-8ede-dbb9c2c53155", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629124708, "uuid": "e16f7387-c112-4491-b320-6bcb94e05ae5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124708, "uuid": "cdef5b18-3ade-42ea-96d8-e188e08dbf94", "value": "c6a0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37caa67-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629126004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126004, "uuid": "6af3cad1-9776-4bc7-bb36-49d2c24dcf5a", "comment": "Malware payload (Mirai)", "value": "b8a7f67fe0d370f590f92b5f21fa585b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126004, "uuid": "537e29e7-fe68-40b9-86ec-f88396acd21e", "comment": "Malware payload (Mirai)", "value": "13a6832fcd82ab54c3a45e56cede4813a40a2b5b95798a4b7d36fc7e84e178ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126004, "uuid": "9ca42e5b-f882-4aa9-a40f-e5e6a0376da4", "comment": "Malware payload (Mirai)", "value": "6a6f8fa960b02269f557425709fd9dd43d347127", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126004, "uuid": "9cea2807-788a-4bf0-8021-cda543a21f74", "comment": "Malware payload (Mirai)", "value": "5db912c7433589b0a0c09566feace3ebaea985da7660be83898c84a14c4d809bbfdb79fd1926839af71917e39c140d12", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126004, "uuid": "37e02fdf-96ee-453b-be86-1215e9b37d76", "value": "T1B2E33C86FA408A13C4C61B76FA9F524A33229B55E3DB73068D185FF43F87A5E4E13606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126004, "uuid": "fd23aa1f-64bf-4375-bd3f-37bc180c7174", "value": "3072:fib6kNRkmUk87JYqN4CjC0FOq/36IQF2aXWZ2M/9k/r:GXRJUk8BfC0FOq/KIJaX9M/9k/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126004, "uuid": "00fb3ee3-a3f5-4133-af99-74618efefa8c", "value": 144103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126004, "uuid": "b58f1144-d5de-4325-8430-b7fde2d04a8b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126004, "uuid": "95fc0bf3-aebd-42b0-b8e4-14c90aff8c25", "value": "94VG.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e729919-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629134156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134156, "uuid": "4d9fef2d-9e31-4856-a7bd-1194d8cbf351", "comment": "Malware payload (TrickBot)", "value": "86edeca7eda24ba0fa3e3ec74c279291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134156, "uuid": "ae0ee581-025d-4592-bb82-fe014293b7a2", "comment": "Malware payload (TrickBot)", "value": "145922b0a4d90db4438ca924535a6f058472744a29b3a4f2875846a84bd41b99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134156, "uuid": "5df278ac-5616-49bb-9a71-62a0ab3ea98a", "comment": "Malware payload (TrickBot)", "value": "263ec7478780a104dfbd6598af8a9f8f179ef531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134156, "uuid": "f569b9b0-9e57-4356-9194-4bfc8c018248", "comment": "Malware payload (TrickBot)", "value": "b7dc74b4855e95ddd06a3f8f0b3ecd81ce2fc771c2d6df4d72b966d0ec5bc92540bf8b1ffd5d330f0e532698a55c6c59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134156, "uuid": "7c5e137e-0ef2-4d84-8095-37a4cc390bc3", "value": "T1B0F49D0135B1AC76D5A111B30EE5A66D5AB4AFC8772149CB67D0BE0C6B72FC0CB36236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134156, "uuid": "14b8ccf2-ad7f-4f3e-ad0a-3984ce6883b7", "value": "878b3c97f2cf4cbb19fae7bf08b6bf6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134156, "uuid": "8b08ebf1-9af5-4977-8c04-242a247f4fe4", "value": "12288:3zgiXyC0EB3NGJwU888888888888888888888H0u7Kd6jIq+5ZWZXdSisd:UiXyC0m3KH888888888888888888888u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134156, "uuid": "f4022a22-8da0-4e53-bf47-ab631945aeac", "value": 778289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134156, "uuid": "0048647a-c277-48fd-94da-7811f88c20ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134156, "uuid": "2f8d25de-3cc3-41f1-a09d-3bcf765cbeb3", "value": "86edeca7eda24ba0fa3e3ec74c279291.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac936030-fea0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629125160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125160, "uuid": "dab70873-7275-4654-b938-4e8771831675", "comment": "Malware payload (AZORult)", "value": "3d2464f216fefa68655ac55172064d74", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125160, "uuid": "6a352916-0be6-4a98-866d-97e818b29446", "comment": "Malware payload (AZORult)", "value": "14a0d25b4d33216e9110c9588fa3168105efdad28827e772c4798337544eb708", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125160, "uuid": "20ca9043-2ae3-4ae2-9f7b-07b52b20d24b", "comment": "Malware payload (AZORult)", "value": "99d8c98dfe10512411122d7f0c84b70fa86508d5", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125160, "uuid": "c4832a25-2646-4892-872c-ef78a8442620", "comment": "Malware payload (AZORult)", "value": "b6e8faef5d50045163aba1c98094fdaebf14a802ba58f6410d0387a291a7182a92a516ae47504d0eba530ca4011cc9e5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125160, "uuid": "493a12ec-2754-496e-ac4b-ad44d095a014", "value": "T185450213F3B4055FF1EA063419287EBB9A29AD395581180BE78ADE0D05E7AC2FDB5703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125160, "uuid": "09cfaaea-5564-4f4e-90fc-943bdbc4aa94", "value": "fb0fb8edc31fffe9bb05edbac608d5c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125160, "uuid": "c2dede02-d82d-40bd-a1fd-8c7c6194598d", "value": "24576:IS72iH9ECoxrUgJPb/EbYVRt93w30lC5IoYvHz:ISbD6UgZBgElC5bYvHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125160, "uuid": "c19c0324-69d3-4165-a813-74060adf5d80", "value": 1192960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125160, "uuid": "872a6131-ff50-48ed-9651-1ccd9557d090", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125160, "uuid": "61edc65f-e66b-4305-a51c-6ad9a16ea9f0", "value": "3d2464f216fefa68655ac55172064d74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc685c4-fe5d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629096493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096493, "uuid": "722b55b9-c61d-4663-90bd-1ad4cc435bc8", "comment": "Malware payload (CobaltStrike)", "value": "54890eb3412d6794d797fe49c73716c0", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096493, "uuid": "a37e91a4-fba6-4dd8-ad31-bb88bd1f1325", "comment": "Malware payload (CobaltStrike)", "value": "14d35d94f1423f8611dd77fb5da29a006a7a59cc9ccd549c46cba36c017b1d2f", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096493, "uuid": "4552bc2e-3a55-4f86-b004-1b16bac40e7b", "comment": "Malware payload (CobaltStrike)", "value": "ed7acb67665323184a5df7964debbd40b75c1382", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096493, "uuid": "3f619bb2-e544-406a-aa46-5ecbbc91beaf", "comment": "Malware payload (CobaltStrike)", "value": "f63e61fbcd085d3d637812737fda602a89133e3e2b500e20100b070b19f0be6c6977337352d5a562e1b3b8f28ecc8e78", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096493, "uuid": "450f0c22-45ba-4514-b165-b910acbfba6c", "value": "T18C944B46FAA485B0E02FD139C9A28B46EBB23458977187CB5395871E3F732E19D3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096493, "uuid": "57349bfb-c0ba-444d-881f-725343a24d81", "value": "0d24ffe13b3120fbab4bd4048451b383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096493, "uuid": "1ce09e76-d1c1-4182-929b-403463cc8b05", "value": "6144:32sBBZySgkNl44nAvRoM9epsxvh9JKkIU6CXbNsZOzbjeUEM70I:DbZySgkzEoGeq9JRIGLNs3MP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629096493, "uuid": "77755880-3e51-4edf-be70-4c925bdac490", "value": 418304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629096493, "uuid": "d4a38f14-00da-4744-96dd-da8a917e1c54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096493, "uuid": "5de1ace9-efa7-4113-863b-68e7743d2caf", "value": "54890eb3412d6794d797fe49c73716c0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57daead3-feb2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629132749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132749, "uuid": "620ba52e-cd91-48a1-b827-6679169db07d", "comment": "Malware payload (Gafgyt)", "value": "07207e2740ce1ea6defa691d44da67d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132749, "uuid": "03efd7e1-0267-4fa6-b9fa-3818ddcbea46", "comment": "Malware payload (Gafgyt)", "value": "15db66c90445beab2e9f472fcb355c06a02a739642cc061e0a4370984dbd198a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132749, "uuid": "142a6b42-84ff-4509-8c08-3344f16cb4e3", "comment": "Malware payload (Gafgyt)", "value": "c241122a13aca973df51d9f2ecac4a9d1f60ffd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132749, "uuid": "a6127708-48e1-4385-9127-7e07bbb8e13f", "comment": "Malware payload (Gafgyt)", "value": "cf20722921437bd6a8b9c4577fa451125b2a32e983186e38b070ae76fda855dd6b91801bdb91e8847cf26b698aa022d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132749, "uuid": "d9de73df-44a2-4e05-8e1a-b7bafc260da9", "value": "T163933A17B71C0B93C49B5AF12CEB3BF18B69F5F112A76185610AAFD40372EB02521FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132749, "uuid": "88669490-281b-44d7-9925-e0062805d932", "value": "1536:cQTjSMib8IPBLBrch40CKkn1ehDedyrB3UFuQumXxVqDrstKfz9e:c0eM8zrchV/QHXfumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132749, "uuid": "9be96924-27c6-4437-b493-5dc34b985ded", "value": 94413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132749, "uuid": "3646adbd-a50c-43f5-99a6-f0ad89a5ec1f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132749, "uuid": "d162da7d-09c4-46c2-a905-ecec41d7ef40", "value": "07207e2740ce1ea6defa691d44da67d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de21d3dd-fed9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629149725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149725, "uuid": "861543b0-159a-4b5a-b9c8-1f1eeeebab51", "comment": "Malware payload (Dridex)", "value": "5700de0858ee2f95fd05d394943f4133", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149725, "uuid": "c486d2c5-8846-477a-999a-9af1789c04c3", "comment": "Malware payload (Dridex)", "value": "1625bee16a2a6e37da02eaa1f25783e2bfb0ffcc633064d347cf88de06ae1df3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149725, "uuid": "541c6d73-bcf7-4f32-b2da-6305b866586a", "comment": "Malware payload (Dridex)", "value": "f6af21839da3165fa58e78f67c918091de3fb7f4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149725, "uuid": "1ed8c147-4b54-4c25-a7c1-893aecb9a175", "comment": "Malware payload (Dridex)", "value": "65a0843ba47cef2da84d402a5ded97d1adcb56c1413fe11ce810ce421acbf53accb04dd3fbb6d3978d2cd40e9f675fcb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149725, "uuid": "a094b20b-a815-4521-a4d2-ff215ed21693", "value": "T1336402264472E1A4DDDB703ACCCF0FEE27E54EBF51905E2AE2D5E91EE905ED220901C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149725, "uuid": "ecc34491-34cf-49eb-aeec-a51f4d6fdbf2", "value": "6144:SPNSLcq+YXEsu+vM0JuIj9KkEJ+byFrxx3P+/jzc5Y3aWTqdbPOKd:QPYXEsnvM0P8kEJBpP4zuY3aMqMKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629149725, "uuid": "27710347-dc17-47f4-92a3-6b98a1a24ba8", "value": 314975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629149725, "uuid": "f39bdd7c-286b-49a9-9f2d-83b8a8f4eb97", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149725, "uuid": "b12c1f8e-39b2-4e89-a791-39b43c3a1092", "value": "taxve_34281_20210816_47827162_76431446.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bd7edc-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629125927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125927, "uuid": "097302d7-76d8-4943-9188-28362cf109d2", "comment": "Malware payload (Formbook)", "value": "1629d235aeafb8f74e3088f79794d2d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125927, "uuid": "d8a7dedc-625e-4e04-86f3-41b1e6bfdbf1", "comment": "Malware payload (Formbook)", "value": "164447ab2383bc200bebb32184a25f05f88ba3d96dd8c1302267252682be3112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125927, "uuid": "2a22ec7c-84bc-46f8-b5c1-d12cfa468cc0", "comment": "Malware payload (Formbook)", "value": "f84376d8d54173282b5872c4951d54bc7c58df1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125927, "uuid": "4d8f25ff-a365-4cf3-bf50-d85bd3809c18", "comment": "Malware payload (Formbook)", "value": "5b6375a42fd8797cd900d171e0e761e9511df3cc323a24d9fa628117924000891b553e1e1c60c1dba95ebe282b7ac9dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125927, "uuid": "34aa0621-3143-420b-a890-7e3594847ceb", "value": "T1C854F19272C5D975E57119305898CEB28A3FFD706E2F8D677708062B1FA42C1DA24E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125927, "uuid": "02480a68-8d06-4b3c-87aa-ab2c1de3b482", "value": "77554e5daa9478a6160428ce3abe1161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125927, "uuid": "f3bb2940-f008-4b72-978e-1ab859bf832a", "value": "6144:AIeaRiOnzGe6VZwZe3cUbm6fde7bsfwIWp/jx1d5e2wan9o7zzKdahzF:AIeaRse6VZoe3comEde7/9b02wan9ozn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125927, "uuid": "8839147d-f197-4ccc-8530-4b388f9c6c3e", "value": 304106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125927, "uuid": "f0180e79-7aba-4d71-85a1-25e549175cfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125927, "uuid": "99b2b896-4fd6-4d5c-9ef1-fd7536a493d8", "value": "bt554219.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64831ed6-fe95-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629120315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629120315, "uuid": "03a3c434-4f6c-4dc4-aa4c-5ee4376494ca", "comment": "Malware payload (AgentTesla)", "value": "c5479339e0fce09716f01fb8ef625403", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629120315, "uuid": "39bafe2a-3e7e-4a3a-897b-876575160331", "comment": "Malware payload (AgentTesla)", "value": "175575bcd0d96914d2e856f266ddc75e0173867bc685e7743c8d1bf3aaa0eb43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629120315, "uuid": "477b615d-7c48-4c75-9dba-1c368b24b7f1", "comment": "Malware payload (AgentTesla)", "value": "202357a513a048b4fdddbe5e2f1dd48f2d7acf06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629120315, "uuid": "e1baf6bb-80cc-456d-bad3-5470b0b23d3f", "comment": "Malware payload (AgentTesla)", "value": "b62764991bed97bd1a14644602d711f5543435251388e2fdd19e9558f4e5161cf8fe0f6eb54a531d429caf20e7e44ff3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629120315, "uuid": "58f98445-fdc6-41a6-915f-b11364905327", "value": "T170F4CF78B09B4A97E61F49B42538BD5002B231F3B9C699390B2A5546CFEDF983F4850F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629120315, "uuid": "a371ec80-a20a-4292-b514-d5cf9e9c6e83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629120315, "uuid": "11f3a642-31ab-448e-8f9f-31ea73255bb6", "value": "12288:PmnmmnAIDv0+/ylBwXkE4RMOWh3ayudeDhvEEMgX3NHHzHWKPK5JOEPpBjaini:emmnAkv09Bw07RMXhYOhBMWHWZHPiii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629120315, "uuid": "32e50ef6-1acd-4d79-bbc7-f3f49c3c0166", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629120315, "uuid": "7d86bdde-0b68-42c7-9b1a-408431703573", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629120315, "uuid": "8fc9a80b-4cae-41f3-8833-133e9bb8f64d", "value": "SHIPPING INVOICE#J09674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4ae616-fe76-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629107039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107039, "uuid": "d63270d0-8c91-4e98-991b-17c6c7e46970", "comment": "Malware payload (RaccoonStealer)", "value": "dc3688fa0caa86c31c983d5d531b0b85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107039, "uuid": "b6fa0547-c861-4221-ab07-42e15dfb324f", "comment": "Malware payload (RaccoonStealer)", "value": "1780d48983335a99ff7054cae2740df7b87e3412d46e99e6a1160769946ff2f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107039, "uuid": "f8ae3416-6c10-4d02-88e9-1cd30597fd43", "comment": "Malware payload (RaccoonStealer)", "value": "d5ee18441cd152a649298761d3955810f610767f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107039, "uuid": "208f73ff-6ca8-4645-9a1f-988248cf1710", "comment": "Malware payload (RaccoonStealer)", "value": "0b74b39e9e4caab778541ef3e62cb92603fc2aa3514daf5dc5a7c215515fdd35708c5624964f796e8037bcdc1a979c22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107039, "uuid": "1b7530c0-ea9a-4b4b-b6c4-1e73bea6404b", "value": "T11CA412213561E13AC0960470CC65FADA2B69BA21F970417B379B5E6FFF302E11B6B349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107039, "uuid": "14c01c2c-d35c-42a5-a7ec-d0b0ee44f126", "value": "1a43dad8615b89dc6e5d071c17cc8026", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107039, "uuid": "56689bbf-426e-417c-94ff-9dd95d28a87f", "value": "6144:7xLkivDziejUeUYaTUCoRLQ7MMEU2TS//QsY2aUZHK7YUrjJOQvLWE+orDlr6f:9oivDjUdYTuMMl1YsY1XYUzWuOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629107039, "uuid": "92db27a2-e386-460d-a6de-160d8a7d35ee", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629107039, "uuid": "891d7f8a-6a32-43e2-b2b1-d1d6ed7ff7bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107039, "uuid": "1a13de84-da73-42ef-8eda-a7bf908a87f6", "value": "dc3688fa0caa86c31c983d5d531b0b85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6e1902-fed1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629145942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145942, "uuid": "9ee67074-4690-48e6-a61a-b7d63beb2ac0", "comment": "Malware payload (Dridex)", "value": "b1532f02c07d41ead7e4ef0fc4c0b11a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145942, "uuid": "cf4da5ed-3922-4881-bfc2-d35bc886bba8", "comment": "Malware payload (Dridex)", "value": "17de988ebd2b722db226a5baed81ae44d7d8c6cf170e4fc1463b1d172375199d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145942, "uuid": "96cb8c32-6857-419a-b51b-0f5be02e7037", "comment": "Malware payload (Dridex)", "value": "42795d998f06285a9223b34b7885c5da8e2af2d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145942, "uuid": "59ed4ea1-eeff-4436-b20a-8a811e1c2f38", "comment": "Malware payload (Dridex)", "value": "be75199af3fcde924a22af034016c7fc1776b30b8d57a94d3e584c0269b63425d9ed38cdfbbd579cc73e8a62fc900b58", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145942, "uuid": "778d7454-ddde-4e0e-a344-c0063f078d9e", "value": "T1136401666453E45CFF9FBE3C5CCE19387F98CCED5A00286F61A1A11EEBC02D62C99485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145942, "uuid": "c6d65e78-eeb7-4746-9d81-26ec60532a0d", "value": "6144:SitZbAPPimNA/kjoitkOucO0/wH6egjRDLPy7hC+H+mANzLW9/lqcj/7EGuGJ/HP:/tZbAPDNAcMeucO1VIRDLP2hhH16Sbjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629145942, "uuid": "0bb3200e-3a62-4569-bed5-6b20b656096c", "value": 334349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629145942, "uuid": "8432aa65-6a11-4f83-9a12-c0a0f1489f2f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145942, "uuid": "30751a5c-f390-4624-842d-27ab0618ff43", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_1_01760.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a547c059-fec9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629142757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142757, "uuid": "9d433f28-4ad5-436a-a48f-feb82cf1fa81", "comment": "Malware payload (Dridex)", "value": "d57e608d67c9d9e165fc925021cf52f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142757, "uuid": "17718d7d-e8d0-402b-abf1-d7edb4cd4f15", "comment": "Malware payload (Dridex)", "value": "184f09043b1566c81b7557ed740dde6642beb3810be2365f7a82054d01edf5ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142757, "uuid": "5e5401e5-a29e-4296-b145-3a3156142018", "comment": "Malware payload (Dridex)", "value": "b27b2fc0e7fc6853b80e5f5298c533b497629a92", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142757, "uuid": "ceab4c4e-ea9f-4c11-8169-fa17d31135b5", "comment": "Malware payload (Dridex)", "value": "c0aedd3dff04aed03dd59dd52dbe3c021f6fbec0600b7f6442e2a9080a55bed03608f7038ca5d04e5e9bed87370864c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142757, "uuid": "863526d7-bddb-4240-a842-1b1e13ecf094", "value": "T1DF640254617BF69CEE4FAC394CDE28746F88DFBE05002A6F22E1B65CE6C53E52C14891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142757, "uuid": "ad4a4f72-a8e4-49fe-9423-3163574457d8", "value": "6144:SztZbAPPimNA/kjoitkqPoumkkP0Gv+qDkipkcdv1Wa68aya4nD5P8pt3pGckRHz:ytZbAPDNAcM6wukMAvTva2D5P8r3pGce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629142757, "uuid": "95eab95f-e0a7-469a-b939-ecd5a09957c1", "value": 322231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629142757, "uuid": "4e345128-3794-4d9f-b376-080a4fbefd61", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142757, "uuid": "329d3ed1-1ba1-4c94-a585-c2bba0d3598e", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_018930335.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bd0127-fecf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629145310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145310, "uuid": "d8f0239f-edf8-49f8-8bec-76497b50dde7", "comment": "Malware payload (Dridex)", "value": "7603bbe8f90b3ba203bfd28cef1af0d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145310, "uuid": "a055de2d-b1de-4981-acd4-ed3a4560e66a", "comment": "Malware payload (Dridex)", "value": "18abe6592b401da7fa93083af881c000bd491b989d646de3c610a3824c3319fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145310, "uuid": "5ef83e02-082e-4ded-93d4-ace7ebbbf09c", "comment": "Malware payload (Dridex)", "value": "fcf860917b99c051aaafe6c795bf5928c3daa0ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145310, "uuid": "a9da8fde-e255-4b51-a546-c6719c2b71fe", "comment": "Malware payload (Dridex)", "value": "dfb26566fab490bf2040f1c8a591de9428acd92f292d00e9852357ff8778115dc58ccc345f5b84c3f8a168f4660cc9d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145310, "uuid": "0f43566e-1c36-4eea-9cd9-0d1a2c2ed977", "value": "T15944F0595427E51CF9AFAE388DEE24707B99CEBE1240663F34E1A42CE7D03C21C954E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145310, "uuid": "092e14ea-4f34-467c-96d6-638ade1cf955", "value": "6144:SptZbAPPimNA/kjoitkdpA3itgJF5DdI/DEABnzzVC:OtZbAPDNAcMtpA3itgJz2DEABn3VC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629145310, "uuid": "8c094282-10f3-4563-9cf9-cc738b684c58", "value": 259992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629145310, "uuid": "9c4c62cc-bb18-4eea-90e7-74d6790191fb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145310, "uuid": "8ea055c3-4f7b-4acf-a06b-61824d0d6a26", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_7_262327497.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ee0155-fe5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629096640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096640, "uuid": "a7832623-4ed5-47f4-a640-9ba457ee7825", "comment": "Malware payload (Loki)", "value": "44228dc89b66a93c54522c72d2620044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096640, "uuid": "233c2e3c-4146-4108-a587-125010b2fdf1", "comment": "Malware payload (Loki)", "value": "18adaff885efa34c76b1159562a33d2cb869faffebcb7af0dd56c099d98a3710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096640, "uuid": "396678c1-50aa-41cb-a825-2bb0fa0d9b5e", "comment": "Malware payload (Loki)", "value": "ba6fe858b007898044ecf5afcf7f93e83829a912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096640, "uuid": "5b6ba62a-cb06-4b81-8f82-77e917424d8f", "comment": "Malware payload (Loki)", "value": "90b30954f2a838fdbd18c51d35682cd38765ef9cc2aef866947d07034967a7f5cd945a76a37ad5ea911fe137d3da6234", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096640, "uuid": "ac1c0215-1d02-48d9-906a-f3e7dc09df1b", "value": "T193E4BF7171A78696F11F8A742538BD5003B231F3E9C69A39175A604ACFEDE983F4860F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096640, "uuid": "a47867c9-c192-4c6b-85ae-b002c3d29996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096640, "uuid": "2d83ffc3-4d66-45a0-aada-cdc87cd3ca21", "value": "12288:IovlneyUH24OmNfANO/uiRIi9xH4Ikc/Z5JOEPpBja:JtneR4IfWHiRIuyIkYHPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629096640, "uuid": "2a87b1e6-1a13-4cc3-858a-102dc593a463", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629096640, "uuid": "90764fe7-52a1-4d82-9cf1-5c2d50b96d05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096640, "uuid": "5f86d852-900a-4705-bdb4-6157c4bca074", "value": "Request for Quotation from - DARWISH TRADING.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db65465-fe68-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629101057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629101057, "uuid": "5a6e3c69-0f76-4e94-816a-ed69c44d9a3e", "comment": "Malware payload (Loki)", "value": "e62d40e9bd1eeab66cb3c781d543b64f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629101057, "uuid": "5dc356ec-c969-4b35-a7c4-2a25ed2e92aa", "comment": "Malware payload (Loki)", "value": "18cd73a838afa7eaedf424631d6a079f2ffe83c8d400d129656cad2fa6260567", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629101057, "uuid": "47b2f236-e8bc-40e2-9abe-978ef2fc2a8d", "comment": "Malware payload (Loki)", "value": "60936844a9b67f04929f02313cbe13216cc5a9b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629101057, "uuid": "881ecada-b9fa-4cb4-9b34-828bd0bf993a", "comment": "Malware payload (Loki)", "value": "6da792a40c91b68a9dacb208870b728d16d76e4bc4c62e9666d126dd464b13496f4d6ade9b4de628a4f03e38f5aa653e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629101057, "uuid": "e2d08bde-46e8-4159-834b-63b52509a666", "value": "T12EC4CF10B9C0C032D673383047B4D1B15D6DB8712B6A96EF63D81AB99F25AC1B93672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629101057, "uuid": "3507a21b-5520-4bec-8813-72cd5dd8b9d0", "value": "82004e82653b7bafbfcf73a18d8cef95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629101057, "uuid": "677ce1f2-4003-4799-a1dd-023a536e1a24", "value": "12288:c3LWHX34JgXZrXhcepr1klgTszv1P9V594uFsNuEjdVIP9hefKUomLn/PUkvau2D:c3LQcepp9TsTh9VHyd99L/5iu2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629101057, "uuid": "75c69336-6886-4de5-96fc-f6e185c4527b", "value": 568679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629101057, "uuid": "46e39cbc-0408-4511-8674-a62bcf40695b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629101057, "uuid": "dea305b0-ff3c-4df3-9649-6fb1f109b2e6", "value": "e62d40e9bd1eeab66cb3c781d543b64f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af29ceb7-feec-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629157806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157806, "uuid": "64c12158-7421-4bc6-8bba-1bf87de2ebe2", "comment": "Malware payload", "value": "15f94b7859688a477a9dca58a7c2e741", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157806, "uuid": "2438d0bd-1d3b-4ca4-a3d5-dce07500b890", "comment": "Malware payload", "value": "199ea02c2c6c0558a0a533b21d7065fdc9e3645d3d6524e4a6951521c3e20111", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157806, "uuid": "ed57a20f-5376-4f5b-856e-1544a7f0245f", "comment": "Malware payload", "value": "0b433dbd3f40a4aa67dd49e45095a8e835834dba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157806, "uuid": "55bd322c-1a9b-4b46-97e6-715ee3db787f", "comment": "Malware payload", "value": "44ef85cf2117c2d677791e570c00ff7fe4ac2e63f2b2bde89d8a03e4d86e98d09b1d848c653f8d185cd30bec6e6d1bed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157806, "uuid": "43d4c479-ec15-4816-a7e0-6009bea02138", "value": "T11D630782BC80E626CBC00677FA5F508E331567D9E1DA32469D161FA07ACFC1B0D6B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157806, "uuid": "ea329efa-2eb4-4fbc-8112-43ceea01f03e", "value": "1536:74blEKw06Z1XjuxfEQ2qm5YB8t46zHMGJok:74bllw0Wc0484EH7Jok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629157806, "uuid": "fc3263d9-f1fe-42d5-8444-ddea93527da1", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629157806, "uuid": "2cf2be3c-af62-4cb5-92cc-12a948729d51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157806, "uuid": "e19297d9-260f-43c3-9d93-49c44347c6ad", "value": "94VG.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0c16b2-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629132251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132251, "uuid": "6dc925dc-5f6a-4164-a6fa-cd0632c1b67a", "comment": "Malware payload (Gafgyt)", "value": "b826f8d3a8dcb4fd528cef9303faadc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132251, "uuid": "f1b88496-19c0-4bd2-91df-2370abf3d8f0", "comment": "Malware payload (Gafgyt)", "value": "1a3dcd1ca74bc46fe792e7d3f6602f15d52d09cfce8f93173e0c2bafdc073e68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132251, "uuid": "32e40921-a925-456e-b283-955c982e2922", "comment": "Malware payload (Gafgyt)", "value": "e7585c8dbcf2d9743c6ce061d7d082334af6af10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132251, "uuid": "5e911dbb-071c-4212-98a5-a5a5ff37bd2a", "comment": "Malware payload (Gafgyt)", "value": "2104ab49b5408b0142d35a6f5f5af894473ce01a062d6b2f44c97c97bfb96c9fe5f47c3af62dc54f237bf74ce444426b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132251, "uuid": "697bd24a-80e2-4497-9331-074abd40b9ef", "value": "T1C2C3952E7E22BFBEE268863107F75F70879521E237919386E16CD6181E7128D1C5FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132251, "uuid": "ebbc797a-732e-42a7-9d80-2f17504e20c2", "value": "1536:bVp7jO1TI2q+feAf2rK/rePexexevh2rK/AeQHLouc5wTQR6jhkzLeE9ZdkRrmWv:yCiJKNc5xyqzZvWRrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132251, "uuid": "14a6b080-8cc8-45f7-8064-c1f82400836b", "value": 129996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132251, "uuid": "f6ad7535-d68c-49b5-8df9-89551f8d1e6a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132251, "uuid": "59d7b515-53e3-431c-9052-cfacf6d3d663", "value": "b826f8d3a8dcb4fd528cef9303faadc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2279e79-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629104983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104983, "uuid": "a3fc03f5-2b2c-44c3-9aed-5deb847ea355", "comment": "Malware payload (Smoke Loader)", "value": "a1d1f7a632006fcdb0ed9d0c635a8f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104983, "uuid": "629f3d97-cf5e-43b7-b882-35330120c4aa", "comment": "Malware payload (Smoke Loader)", "value": "1a471836c805bbee8b08512c7a813aa00c5df6dcb11888d39bf652afb7ab36f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104983, "uuid": "034dab3f-4387-45e1-9d98-1769c5675dca", "comment": "Malware payload (Smoke Loader)", "value": "d4b2ea32696887a8c0fadcbd9616a50311b1826d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104983, "uuid": "b81f9d53-f813-46f6-8bc0-81e94d0f3aa5", "comment": "Malware payload (Smoke Loader)", "value": "f9e9a5c465e1ccd6236835fd557f91016e61833a16a36acfa6f735362ca1b9ba5b8df04826ce1a7ee7c0fa27a3171a18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104983, "uuid": "4121372e-c651-41a1-9c7d-3227710f237f", "value": "T1B704CF1D758FC872C38EF43144B38BAC9A389B21D613097B27B83A5E5F34EB15666349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104983, "uuid": "de13d933-ff58-4f19-a3f8-1d18893f793d", "value": "b6eb307a53194f1a2629d22afffc5564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104983, "uuid": "dbe07e75-f431-47ec-a0f9-4531c8732dce", "value": "3072:5LEh9DeIH9axddbqtESNpbTQdZBNzMRnc/mRM2Z7yz:5LGIFePrE6c/mY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104983, "uuid": "a46fa55f-40d0-41d8-936a-07891787502d", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104983, "uuid": "d663c30e-b6dd-4901-9cdf-0526ebf69a58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104983, "uuid": "5b9a499d-9e5b-4317-812b-6e40849fb0de", "value": "a1d1f7a632006fcdb0ed9d0c635a8f0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b132c2-feba-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629136291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136291, "uuid": "0410eeaf-bc9e-4e1c-8355-210cc0671cdb", "comment": "Malware payload", "value": "9de8bad5f19636e261d6e47a093b1143", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136291, "uuid": "34a35726-e053-476c-9899-d46109d92d63", "comment": "Malware payload", "value": "1b80164c9621b7d5c0f0ff55ecb7b6a131e525e3d4dc637caa6076e2674ce928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136291, "uuid": "1bfcf7f4-a18b-4393-aab0-cd028f6839e3", "comment": "Malware payload", "value": "977b8da15a3d2cc19cd38133a016da5753d2ba79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136291, "uuid": "669eadf4-3cf5-453b-bda2-4a8b7d2de007", "comment": "Malware payload", "value": "7c91fb61940c833080f527ebf14b36c43e206ed715046a0815f6fbca26cabeb7f23d42f3bbc35319d9f773891a33f727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136291, "uuid": "ab1d519e-4951-4dae-ae91-af212e504a77", "value": "T1088242A9F3A6C0A7D49A6DF2A4F71F7020A5BF028D187B4925E58E1676C01EF7F25007", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136291, "uuid": "d092970a-1453-4634-81b2-a2d1c99c153b", "value": "384:kihLcXl0dRnOpoVjzqIrWzgC5Rw66+GoU86FRLHJryQZOKSS+C4uSwM:Lhgl0doyv639OR1OQZTHx3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629136291, "uuid": "4acf59df-00c8-4aec-93a2-9511f4641d2f", "value": 18581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629136291, "uuid": "b4d8bef7-bc2b-407a-9d51-1af854ec80ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136291, "uuid": "fb487b62-05b4-4eeb-89bd-bb6c59f46fc1", "value": "9de8bad5f19636e261d6e47a093b1143.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a5fd8e-feba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629136185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136185, "uuid": "9581ab69-26fa-4d0e-95df-97a70b27c71f", "comment": "Malware payload (NanoCore)", "value": "fe67e734f9fe03bb0652862acf76bb3a", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136185, "uuid": "6603b8cb-6f51-4609-a4c7-92307ff35158", "comment": "Malware payload (NanoCore)", "value": "1d546559c2c605bb9bbb3d1ee89a0905a9e7ec84cc7ccce39b766f9408201b67", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136185, "uuid": "7308cd76-56fb-49bb-ac33-a30ca1335cba", "comment": "Malware payload (NanoCore)", "value": "ddac555c87369fd6d813333b807c15719bc4ef3d", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136185, "uuid": "52fdde6d-b978-488d-a158-97fdc7ebc8c2", "comment": "Malware payload (NanoCore)", "value": "c0564c96bb341fef2ad253405145162989dc3f0718445649b4a6b4d8a465a7ad64a53d45b143b664e36fcbeb91221ec4", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136185, "uuid": "433e2c85-aeab-4592-8f16-e70c9e5ab428", "value": "T1BEF4331B5139A8BAD547A4143CED657DC0E2328BD1637E84EE31E4461F87BD7E3B8888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136185, "uuid": "c04225e0-c3db-4e5f-b68a-2e20e2a8cfdf", "value": "12288:VzlaGdQUbCWbEpircItZ3QfMcafb0syyTEXoGnRSymanKSPjZ2jZTpof4/DLaiwA:VzlOUjl4KZ3vckbhJoXoGn8ylPjZyZoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629136185, "uuid": "785acc0c-dfd7-441c-b2d4-e85870fef350", "value": 739767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629136185, "uuid": "0d08e632-b0b5-43b9-8f2f-b4da31e8c7c1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136185, "uuid": "24eb6754-8b74-4392-b989-b138dea61898", "value": "PO83783877.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7de7fa-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629134072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134072, "uuid": "9320da37-4eaf-4275-a310-347d6e45a122", "comment": "Malware payload (RedLineStealer)", "value": "e7e9cabcce983826f3fcf49e79907c8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134072, "uuid": "d8c3b2a3-290a-44da-b109-d4a9c103c6d9", "comment": "Malware payload (RedLineStealer)", "value": "1da5852a2c29d3adcd71f17785e5f8e858e5bf82753d7c8ef9a06aaa2db31dff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134072, "uuid": "d10979e0-c901-408e-8a73-14b38dec1ab0", "comment": "Malware payload (RedLineStealer)", "value": "510458242d5e46dddd888ad6208ec024981b9d70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134072, "uuid": "c1cc1421-14ee-4a03-aad6-be3f89d1d4a3", "comment": "Malware payload (RedLineStealer)", "value": "7fb558cc366c4dc9a9825566ad01035533c1c218b0fc711bf615ec9f96eb0612caf7a444db9eaa59fff87b9b075f0f2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134072, "uuid": "af5fb1c7-8bbb-4005-a9db-ec9b0487e28f", "value": "T15C54F1317EA1D5B2C89AC474E462FBE1DA6ABC21E680444F37582F5FAF703E0562E345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134072, "uuid": "88637c4a-fb0c-431b-b445-5f1dfdb2668c", "value": "18e06f4ffa7867d98b45ecadeffea13b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134072, "uuid": "a9734e5e-cc4e-48b2-b9a9-35aad9c2a53e", "value": "6144:bL4LZhAuo3fLYIEVt35Fy1EfE+H5C4Mcl:buhe3fTW5F4E1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134072, "uuid": "cf9d9c60-3583-45df-9278-7412ebc139e0", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134072, "uuid": "f27f06e3-7d95-42e5-b3c7-221a15b129b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134072, "uuid": "749ee5da-1289-4d03-8646-8d69c63cc545", "value": "e7e9cabcce983826f3fcf49e79907c8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bafb10-fe72-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629105122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105122, "uuid": "fac04137-3102-4bb3-9286-bcd9dac583cf", "comment": "Malware payload", "value": "aa2f0d196eacb97f25f8a0688d087967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105122, "uuid": "562650fe-f338-4b34-911e-50920a35d295", "comment": "Malware payload", "value": "1e445f6c58a18464fc758839559bada7607f882900831891b28d314b2bf77d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105122, "uuid": "83d35724-5ebc-4126-bd4c-9e8136718ebd", "comment": "Malware payload", "value": "20a7e0f8c1c6ff9f9554037e4f16e49f309d54c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105122, "uuid": "052d90d0-e203-4d32-8112-5abd6f743632", "comment": "Malware payload", "value": "625e4a971d9acb2a95649d9c733eaba6ef32e36fb7ad40d9e8e5006c440f5d284e69072acc2f8ab5966c94606027f8d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105122, "uuid": "1aaf63c0-24e6-458b-810c-e8de613d803d", "value": "T161E469918EEFCDCEC26F263FA01A0C9614DEC3160787A6E19F564E35B7841279D261E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105122, "uuid": "33b71ae8-b041-41eb-9597-5efd588c0e8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105122, "uuid": "f2eea796-c6dc-40b9-8f58-abd472021b94", "value": "12288:i9Z4u6//BDZvu2bHdtJEXao17v+pEiyYm1xdcB8Vop6lXr0JKpDEGk:WHGJ1vHJNobsEiyYkCqGp6CApoGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629105122, "uuid": "9b27a615-10b8-4f1c-9ce5-8219cd87afcf", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629105122, "uuid": "99971ebf-7c03-4eb2-983c-e3856cd3caee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105122, "uuid": "9e9cb767-96e9-4060-aad2-8ebaf5d591c1", "value": "aa2f0d196eacb97f25f8a0688d087967.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3554bb93-febb-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629136557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136557, "uuid": "1b8519f2-1482-4295-bb1c-99a35f6ba8f1", "comment": "Malware payload", "value": "019075885127490e0c372310d8372c27", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136557, "uuid": "8731511d-8bfa-463b-bcc8-903634530883", "comment": "Malware payload", "value": "1fa5ff1862821419d45699278a53bde606a8764006e3a26b315b78521d532691", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136557, "uuid": "6a23a137-6a8a-4870-8ced-5a136c50ea61", "comment": "Malware payload", "value": "1206f1255d06c08115f91a4c38397abec8c9aa33", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136557, "uuid": "1a3e6316-f3f4-499c-abe5-3a271d814a1c", "comment": "Malware payload", "value": "ccf26be0ced4e383a4f8708c334d348c6b8b4eeef3de24cdd0f72fb52c2f880b99806217f037d3856e4ae6814305d8fc", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136557, "uuid": "95726177-1d54-4dc6-b38b-b79a2fce99e5", "value": "T1EB22FE907DC8A830199496E8A21DC8C25F7DEA61DFBCE78FA0FB975C584234ACE3514D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136557, "uuid": "33407e35-bf15-45d3-a102-00f82f139bbe", "value": "192:q52nx1ymh6TyTDgx3u7YYVmp67P5HF5999kk999VxG8b99l9JK9w27DBDvV7xByg:q5ELymh6TyTDgx3QYYMc7BHF5999kk9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629136557, "uuid": "d829b0db-5829-4da6-911e-51aabc541f8f", "value": 10025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629136557, "uuid": "78d6c5e2-ca9d-42e1-93df-a319b2077c54", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136557, "uuid": "fa9573ae-f65e-49c3-a3fa-5d5946b5c851", "value": "03-385819.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea472da-fee3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629153725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153725, "uuid": "8614fabe-511b-411c-b293-cd9469a615d6", "comment": "Malware payload (Dridex)", "value": "315ac4cb1626d45a3988271d68f50974", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153725, "uuid": "7a72da1c-18bf-4f57-96a4-6d014d5c6ad3", "comment": "Malware payload (Dridex)", "value": "1feeacd85d4c7dfebe07a2851d604eab37dcd9a09869f7e7686f36fc38ca29d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153725, "uuid": "29139595-787b-41ab-986f-f51cf894aff8", "comment": "Malware payload (Dridex)", "value": "a80338304fa25d68366de8970d5b0c88be3d0f3d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153725, "uuid": "a4cc690d-f8f2-4d9e-a428-39f62bc72523", "comment": "Malware payload (Dridex)", "value": "ce37e4a0e992a7c548680e19e316971408b951a74b3aa2515ceacff1571b08c4beb74b7f4e5a2846fb309f06c0a7ba16", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153725, "uuid": "45cb8e6f-2caa-4bd4-8216-b3f6dc91661a", "value": "T1155402552513E55CFE4F6D798CEE28B47FCCCDEA068029AF11B1E11CEAE13DA1C68984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153725, "uuid": "488a3fa5-dc17-49e6-824b-610e0fa952be", "value": "6144:S8tZbAPPimNA/kjoitkqQjpSqxNUJPXNmSUPvdFkQgAs:5tZbAPDNAcMaQVl3UJfISUPvd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629153725, "uuid": "2aa11064-293d-4c43-b061-7ca8c8126e52", "value": 279590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629153725, "uuid": "8d28ce0f-9fff-4025-8772-6a44aa63a09c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153725, "uuid": "ba1d6bf3-cd72-49a3-99cc-d35806789df8", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_7_68011890.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ef05c9-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1629105099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105099, "uuid": "22999e90-6786-48ff-ae1c-51afca8a9b2e", "comment": "Malware payload (Glupteba)", "value": "4c3a81593f9b3ebdac34cc8cd85c517f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105099, "uuid": "25444800-29e6-441f-b76d-4d11bb02155c", "comment": "Malware payload (Glupteba)", "value": "203a03884451e5f74fa167f4708e19722f1d91ba434957aac1ba13f1a3d70127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105099, "uuid": "93331bf6-87fc-458e-ba9e-d83a781ebd1d", "comment": "Malware payload (Glupteba)", "value": "724c029d815ec2dfd70b28d7b14e9ccb8d0abc16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105099, "uuid": "44dcc076-99e5-4d4b-ba91-382b7dd5fb77", "comment": "Malware payload (Glupteba)", "value": "a3a1db7523b49ec6c63d4b48d9cbd46a99f7449114e7644c9c2c3821748bf24149c24f53bf98fe8c2314a552c6e8d0b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105099, "uuid": "f847f887-8930-4f9c-acd4-92b008227c28", "value": "T1B72633AA2D438272DD03733E62F38B1CD51D4B47C5272C2973DC0F9A8AB2751A6276B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105099, "uuid": "f4ab2a45-c746-490d-bdf9-1139012601e9", "value": "cd5c28f44b3cca36a31a3422b8479df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105099, "uuid": "64ec21fc-eedf-4602-bd49-9a5ee911741c", "value": "98304:/v8e2nt0lVEc0q6ANKL/72csD1DTUlh0xXfoan/:HNIt0lOcRsbiDTUIxXfoa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629105099, "uuid": "8838928a-83c6-42b9-9526-0f258474ff82", "value": 4573224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629105099, "uuid": "11c35c5e-3ae4-4520-b2d1-f702365d9726", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105099, "uuid": "c74501b4-92f7-42b2-89e9-264c51e83d34", "value": "4c3a81593f9b3ebdac34cc8cd85c517f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc858faa-fe6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629102907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629102907, "uuid": "5b4527ba-d970-4da8-bbd7-11643a2147ab", "comment": "Malware payload (AgentTesla)", "value": "9156f5016ec54a23f8aa9689bf97d149", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629102907, "uuid": "de6f4eb8-9212-4b6f-8260-cb2bee8e223e", "comment": "Malware payload (AgentTesla)", "value": "214fb0417a7476430e54a9204a8d2f5a3e73cdf23ff12a79dd7c19635a4cc39c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629102907, "uuid": "69e92c0d-b1c2-4fed-8b7d-7a9fbd752986", "comment": "Malware payload (AgentTesla)", "value": "76bd4e74ce7a1a3d672a192850400f741bcc35cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629102907, "uuid": "98755191-49fd-40ab-ae3d-424dff5315f4", "comment": "Malware payload (AgentTesla)", "value": "1b916fe33a35aa118995301c91d2c4922cc696bd2d11c1a639e952f267829e23bb42dba3ca27ed38a14cdc59d9b81d41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629102907, "uuid": "6fb638cf-8dfb-4db6-a29f-eab5ede427c1", "value": "T1EDD4239E63A8F5D6380A3D75F8595A29C8B202D80D799C84FEB1463F9F1BD3C15112AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629102907, "uuid": "4c8bdf13-27e9-4a3a-9b49-b4dc808cf805", "value": "12288:oAz5htYGnxuULUfb5dzpUKa/3fmriK2BcpD4rKCa8ycg5:oUhtRxdw9pUKa/vmrv2B041CZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629102907, "uuid": "aee02817-17a0-448d-bea1-727c18ab0a11", "value": 597387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629102907, "uuid": "f78b4e95-8f22-4d51-9a17-1711c9a834ab", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629102907, "uuid": "eb13e64b-a7de-4f5c-8123-98cb5474dc27", "value": "QTS TECHNICAL SERVICES CO., LTD SOA AS AT 31 Jul 2021 - USD.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c239648e-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629126056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126056, "uuid": "fc80b5f3-b516-40d9-b152-ca2762150a4d", "comment": "Malware payload (RemcosRAT)", "value": "936b95a21de0cd97c39e824b6c912cfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126056, "uuid": "80e3c63c-86d0-41fa-aa02-a5980f519f52", "comment": "Malware payload (RemcosRAT)", "value": "216380841574365968ee39421e67eca7875d16490721686622eda5b47f9105ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126056, "uuid": "60d1ed8b-7c30-43c6-a298-ee260c92d59c", "comment": "Malware payload (RemcosRAT)", "value": "78a00b8a7311fb83efe122cd167119cf2e97d4c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126056, "uuid": "44908172-7c63-4bff-82ba-fbf1f40c2260", "comment": "Malware payload (RemcosRAT)", "value": "caecbb36285fe1fb33b3ea7407075e849c513ac0997bfe0474dda231e9a20298eadc9869d26ec41ad57ccf6e39e4f26d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126056, "uuid": "858c6e11-a1ab-4bdb-946b-627050ccf0bd", "value": "T10FF4BF10B4C4C0B3D6B628714A7AE27118AC78746A5A55CF33982B7A6F717C1983E73F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126056, "uuid": "3058a84d-356c-4c46-8117-0d371e3e5215", "value": "82004e82653b7bafbfcf73a18d8cef95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126056, "uuid": "a4a8c0bf-2373-4a8e-ac82-65ad8c1107a3", "value": "12288:03mZHX34JgXZrXhcepr1klgTszv1P9V594uFsflzAKp25NIJLablNgFhBn7v/x/:03mfcepp9TsTh9VelDpANeLy3g71jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126056, "uuid": "1a8b1f6e-5397-44f9-bebd-ae3597035e23", "value": 774305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126056, "uuid": "007c433b-b617-4e13-a6d3-bdd6cd5cdbd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126056, "uuid": "ebb1cefc-873e-4152-92e8-1248589009e3", "value": "Order_WJO-091120947.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf077ce0-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629132493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132493, "uuid": "d654f80f-8099-4963-b047-3cbd5a2e8974", "comment": "Malware payload (Gafgyt)", "value": "3dce73d9f31630078af8b4b4bf678165", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132493, "uuid": "eb7d2c8a-1089-4fc7-a2b3-c49b2a8512e8", "comment": "Malware payload (Gafgyt)", "value": "21a08c606021601bc868d7eb6dd3d60d14d71f3eeae963c3ab727274e14b07a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132493, "uuid": "228fdc6c-5ada-4975-989f-ac1ef8ad07e4", "comment": "Malware payload (Gafgyt)", "value": "66882498c785dd1cd5b9578beca8d9d66b9b7465", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132493, "uuid": "afedcdd2-e7fd-49b1-8a9c-2a473124092c", "comment": "Malware payload (Gafgyt)", "value": "885ff802a79bd0da5af2633241b1d92b64bf6e61be3a6e919e6281a359952fc0ba958d36a3678edbe83d3b200e5d4139", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132493, "uuid": "3128b794-c782-4b13-ba9a-517fa37e4eda", "value": "T16FA33A44FC418727C3D327BAE78E479D3B355A9467D733116A386EB42BC2B892E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132493, "uuid": "5aabfc8f-6c07-4bc8-b627-d5cf9cad9c31", "value": "3072:fuo7RVFjpBx89PCvN0WmZuqQ4DPwXXtse:f3jp789PChmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132493, "uuid": "4616ec62-4e34-4527-aa03-0107deb65c29", "value": 101113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132493, "uuid": "6ee1c948-8c85-449b-96e6-3c9a80e6681c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132493, "uuid": "2430c96a-8b75-44e6-9c7a-f2f5d57d9ee2", "value": "3dce73d9f31630078af8b4b4bf678165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f113eeb3-fed5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629148039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148039, "uuid": "2b3ac3f5-e55f-42a1-bf8a-12f833e82083", "comment": "Malware payload (Dridex)", "value": "f2c5bc68add932373f581365cf249ecb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148039, "uuid": "c50be21b-056c-4d70-ae3c-1b8d4e36ef31", "comment": "Malware payload (Dridex)", "value": "21ac184352fc0a9d83f4e93db5f78f792a1074e143eb0fc68c139a7a198e2601", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148039, "uuid": "b988fcf1-3090-4eb2-9a4d-c61f83b9d2db", "comment": "Malware payload (Dridex)", "value": "14533a43ea3a7b78812e0263810d44f6ad82012c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148039, "uuid": "4e3e3ab6-790b-4387-8cfe-d494318f00bb", "comment": "Malware payload (Dridex)", "value": "fa0f750576837d5f1e29b4d0e10e72ea8d15d1025cbe48b326b4bb5312eeaeb3fca11403124eb14a2a8fdd787d543a0f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148039, "uuid": "dd875f0e-b37e-4b7c-ba00-816198afbba4", "value": "T11E44020586B6F165E9A294384CCA0FD927B6CF6F44D07B13B1E5E15DBE04CE362B098B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148039, "uuid": "f68fa4dc-1ba2-4587-b4b8-68d8cb872812", "value": "6144:S+NSLcq+YXEs5SYaX4zMY4DfqygwREk4a:7PYXEsVzzMYkSybEk4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629148039, "uuid": "87121acd-774f-4baf-a302-a04252ea4b06", "value": 265742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629148039, "uuid": "5a977fc6-0bc4-4744-ae15-ce6eee927931", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148039, "uuid": "42bfd863-67e9-4cf9-af0a-b1e11b395fca", "value": "taxve_4857538_20210816_337777_81478.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3221b0e0-fec7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629141705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141705, "uuid": "378fc3f9-67c5-4b0b-bca1-9ac268328af6", "comment": "Malware payload (Dridex)", "value": "2ab7590fe165c9167d84ef2cdc0e02a2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141705, "uuid": "8f90a9e7-ac5f-43b9-a75d-8a909472d3c4", "comment": "Malware payload (Dridex)", "value": "21e2bab61ebddbbc47292ed5ef733b56073cd8590959ebeb01c583f7180612b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141705, "uuid": "4d632133-ba78-4024-b5e4-1aba0c027f1f", "comment": "Malware payload (Dridex)", "value": "e81bdf750bae5674afa91901d9e1283881b27c72", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141705, "uuid": "8427c95b-1043-4b1b-8ca7-50f3431c0d4c", "comment": "Malware payload (Dridex)", "value": "4799aa4ebf96143fa4e21d2e96a3acb57f77bff9dbf264725f3053640bf0b047c64ed80c96992cb1f52f304c75a8e0cd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141705, "uuid": "ab4da6a0-5441-4260-9ae1-57fcb04b7b9e", "value": "T1F64402246867E95CFE9F7DBC8CDF28752FCECDAE05402A6F60A4A90CE6D13D24C11496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141705, "uuid": "6bef078a-f8d2-4c24-866f-ae4d134b580e", "value": "6144:SotZbAPPimNA/kjoitk3R0hFEWETy4e/+AiOdPXMDnpVfblao:vtZbAPDNAcMR0hFEWETU/mOVcrfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629141705, "uuid": "1e55da8a-4f5f-4296-b38a-20c1b74b38aa", "value": 260171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629141705, "uuid": "028dcf29-7f31-424e-a93b-f8833c8e04e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141705, "uuid": "856709aa-c0c9-48d6-ba14-efcc48b85187", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_4_2484389711.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b28cc1-feba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629136373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136373, "uuid": "cea5c5b7-9ed4-4a95-98c0-249e426a4a3d", "comment": "Malware payload (TrickBot)", "value": "37e26534b70abd664cfed4961ad6ecbf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob122", "colour": "#D387A1", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136373, "uuid": "284c6a8f-fb5f-41dd-a638-0a6eceff4446", "comment": "Malware payload (TrickBot)", "value": "22068c7cbb40c3149b694b5fca1675d95e7e12509b36fa37350c194737c6c1f9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob122", "colour": "#D387A1", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136373, "uuid": "74d5fdc0-04af-4fa3-ac64-e968c7b062dc", "comment": "Malware payload (TrickBot)", "value": "a61cda70371db1c12965c236bb485392df957ce7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob122", "colour": "#D387A1", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136373, "uuid": "ede66209-79ce-4114-ae94-46e3544e4ec8", "comment": "Malware payload (TrickBot)", "value": "9e9f48d9aac2a847a0c571d4fcee00eabfa8fc3d53dc42e13690a684c24c0356df1b84defe704a892c335665409b060f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob122", "colour": "#D387A1", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136373, "uuid": "a270e17d-32a5-42bd-9bf0-de46f6269fd1", "value": "T1BEE4D0273C91502AE46C41BE127DB718CAEEE41242F5E54FFDD5E1F80CA28854AEDA1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136373, "uuid": "d373f206-411f-423d-82ec-880037eaf2f1", "value": "9330bf385780db42e73f6bd2f0835d5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136373, "uuid": "e69cd9fb-0ed5-4906-856c-689a4418c4a7", "value": "12288:T8F4fHXi7upUbuedoBYi5SG//xm6e2vJQbPzSzTu1XLxh2w:g4aCdsjmHxw2vJ8S2FX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629136373, "uuid": "fa350603-19a7-41b5-ac41-8674e2ea0d45", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629136373, "uuid": "11113597-e262-4ee0-8194-64cb43525330", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136373, "uuid": "86f075e2-db9f-4943-81c5-2f992386fbed", "value": "37e26534b70abd664cfed4961ad6ecbf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4061860f-fe91-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629118536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629118536, "uuid": "e948935f-8b61-4a3e-bedf-ffdaa6d18c36", "comment": "Malware payload (Formbook)", "value": "73c3916832698d6d47cde8593d7816f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629118536, "uuid": "2610c0e1-1358-45a7-89a0-1329db7ba276", "comment": "Malware payload (Formbook)", "value": "2289ed4365f6de6fbfc6b2faa52cc0e0e4f898468ba079b3f58e29d9a73e49c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629118536, "uuid": "949c9b7a-440e-488a-9e0b-00a2a9404879", "comment": "Malware payload (Formbook)", "value": "f71d913a603139af9e59fbd2aa462a834e929dfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629118536, "uuid": "ec992cd5-a86a-471e-87d2-e07a7e394eaf", "comment": "Malware payload (Formbook)", "value": "75b9b2321f4c3ece828dc0de75e277d1320830f45f482756cac99f2f5a5c79d8c32c9ffe3a37f583f3556dae79304dd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629118536, "uuid": "a797ed19-2ea9-4eea-9731-28f55bc3cad5", "value": "T15005CF7170A78696F61F8A742178BD5003B131F3E9D699390B5A614ACFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629118536, "uuid": "175eebdf-bbfc-481b-9ec3-1857a21d9e61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629118536, "uuid": "653ffda1-731a-4dbe-857c-c107b106751e", "value": "24576:G0GGGGGGGGGGGGGGGGGGGGDGGGGGGGGGGGGGGGGGGGGGiGGGGGGGGGGGGGUGGDv0:G0GGGGGGGGGGGGGGGGGGGGDGGGGGGGGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629118536, "uuid": "65e1d306-0898-445c-8bf4-8ea9627046d4", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629118536, "uuid": "537414d6-6cea-4df9-a12d-90a94634ffd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629118536, "uuid": "afb200f4-a6de-44c4-9fa0-b38c306d078b", "value": "73c3916832698d6d47cde8593d7816f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585e081a-feb3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629133180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133180, "uuid": "24a54934-f87f-4471-bad4-9b31bb530c1f", "comment": "Malware payload (Dridex)", "value": "db501f895f9484778acee8cf9082bc4c", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133180, "uuid": "f044aaa8-6f97-4350-aaa6-cc1568b7542d", "comment": "Malware payload (Dridex)", "value": "236afa18e176b81eae8761d569c94b16cc681096b12080f5fd489a818c21a1a3", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133180, "uuid": "a345d713-f4b8-46aa-bf30-7c8820b34387", "comment": "Malware payload (Dridex)", "value": "04be2c451e78326e1568302fe7a83d95c65ce4a9", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133180, "uuid": "f739b92b-90af-4ab0-a8a9-c0ec9e033fa8", "comment": "Malware payload (Dridex)", "value": "ce5dbf10fcb9b99cd2832feba65cca673e06b90b8b1521a3dd9bbab792443e325ab739e24bf323f215c7f04ea85ec8ce", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133180, "uuid": "4cd48b5a-66a6-44b9-a872-f0f238c98d1b", "value": "T13414DF83E766D3E2F6C31EB01D7A90226C54B74BEC0CD265DACCE6A9D9B7485023C395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133180, "uuid": "c1b2c17d-25ad-4fd7-9ead-1e01f0dd63ec", "value": "91054cf90b4e18644a12a338dd1fd0da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133180, "uuid": "ca504a99-8265-4ca6-bf32-2529ee0db4e6", "value": "3072:qggIAiwo9/ULHR5ZnJAeoYrBiUckiJn62mTHuxpucxJQ:qggIAi1/+VJAM7cki02GOPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133180, "uuid": "cc02a70c-e73e-4eec-b485-504c05ad6d4d", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133180, "uuid": "4ffb5490-49c5-4137-a98c-2d5e7de5a5f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133180, "uuid": "840b1483-1c85-48a8-87e6-40f27c178af9", "value": "223_mod.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ef9908-fe5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629096556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096556, "uuid": "75898b7b-aa4c-4e28-bd16-88129ba6a6ce", "comment": "Malware payload (AsyncRAT)", "value": "cdbf6721a59a353e460efb19a5df2bc0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096556, "uuid": "693cab93-9507-48e4-99dc-c88ba656e8b9", "comment": "Malware payload (AsyncRAT)", "value": "23ca2524056b8f020707b5d3fc559040a2bfd4803a120e282cb24f67514e4759", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096556, "uuid": "246576c7-9a4b-4aec-9c3f-11d1c6edaab9", "comment": "Malware payload (AsyncRAT)", "value": "8cdd98e961f17722da3985312d31952e78195aec", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096556, "uuid": "f25efe1e-e319-4f40-94c0-4237626c5197", "comment": "Malware payload (AsyncRAT)", "value": "dc201672237a01bec3668053f85350c85990a00bf4e2aa9c844853134f90987ed8b95845b51978260f0149d3391facba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096556, "uuid": "72fc0605-9f8a-4150-bdde-f1877643e355", "value": "T18D239303378BE316D43625B5C4FB192203F56B836133D9AB7E9916CD59022D7DE8A7C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096556, "uuid": "4750f984-d208-48bc-81af-ccdba72da7e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096556, "uuid": "9f438aef-828e-47f6-86b2-26bb9ff50cf9", "value": "768:uaT/Vtqulip4/uBa1194KQwTyXh8D4VPYqgqiaBDj+biBSC2GqE:ugopgd11DyyDOPY3sDj+bi4rE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629096556, "uuid": "1e678b63-b6ea-4203-bc73-bd2ea35bf4ce", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629096556, "uuid": "5938395f-c314-4679-aa98-b822faf4dc69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096556, "uuid": "8953699b-bdb7-4ed0-88aa-e75e4b39f313", "value": "cdbf6721a59a353e460efb19a5df2bc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f70c09-fe5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629095249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095249, "uuid": "aa1e4d02-871e-49d4-891e-93bfc709c86e", "comment": "Malware payload", "value": "a977ed90f3fee5a424476612770c4276", "object_relation": "md5", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095249, "uuid": "84b505af-70ac-4ec9-994e-070c706b5a73", "comment": "Malware payload", "value": "248a1bc40fc98606fda2b0aae27694db8fe7a5399d9a205b509326eb0440dfcf", "object_relation": "sha256", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095249, "uuid": "1c9269aa-0917-4d44-a9c5-81f5d564dc82", "comment": "Malware payload", "value": "ab7dae3da7106541955fe5b4d6b0195d7f52f447", "object_relation": "sha1", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095249, "uuid": "b57cf1fe-c713-4822-9cac-bf52c6b7f0e7", "comment": "Malware payload", "value": "d0e7ab19a08a7e417c9538ce1a94762343c89b5baf6d526f208640fe96c63fa4ebbc501c6c8033449aba719e4a5f9391", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095249, "uuid": "cfe7b123-abe2-4b12-bcb1-a29f1f4b0b09", "value": "T12EE3120A88D2D47EFA8FDC97CD88DB403D1E8AF7D54071FD28528A72DEB266A3575060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095249, "uuid": "c9a1d655-df22-4fa3-a4ec-62bce0d90df8", "value": "3072:/3XnPrUudo/6v8HQkDwbzLgKQV0qUN+w3gF3MhJEMEoZn+0O:rI/6BzLvQV0hUE3EKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095249, "uuid": "5f412b7f-509c-458a-89a1-0b22103146ae", "value": 146862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095249, "uuid": "ef7f806d-e15e-429f-9081-b3a685b5417b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095249, "uuid": "e680bbc0-fcf0-448b-b1a8-a333cc4ac56b", "value": "Swift Payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61231911-fe8c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629116444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116444, "uuid": "f07597cc-1399-489a-9b37-2e71c6c04647", "comment": "Malware payload (RedLineStealer)", "value": "9996968bf823f79bb6cd767642974947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116444, "uuid": "61597c25-79e2-4d95-b0e0-b82b24765087", "comment": "Malware payload (RedLineStealer)", "value": "252a203815e00302d4eda7c66b0432494adfaadd555859ee89ca775dc013fe76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116444, "uuid": "fc602c9e-5314-4315-82b4-dfb8d8bf1361", "comment": "Malware payload (RedLineStealer)", "value": "51ec008918335b895fb8fecb186dec0dacdd64d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116444, "uuid": "94c1c6af-4fb6-42b3-8f68-4d5bff73fcc5", "comment": "Malware payload (RedLineStealer)", "value": "c2ef8b7ed38b86d30d1a4cbcdb82473edfd4345e6c5325e2d7021dce6e582e2ec0ec0f3f998c6ca8f0251563b7ae65d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116444, "uuid": "5d25bab3-128e-4656-bf7f-4f223d893b73", "value": "T10CC3E693172C8873C0872570F0750A07E553CF5D2A8BF289FD5DF29AA9AD24D78B724A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116444, "uuid": "1e2ee60f-bd5e-4ab3-84fa-0b5fe902cf3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116444, "uuid": "a70d8a2c-9d8d-41f6-915a-6bfbb7e7ae49", "value": "768:9JdgkpNOATeB0JjsDnyA6q4bLaHZuVX+UHLzLGITR5dcc3sm1aINY8fsv8TNi1XB:TdzTsDyjq4/aspvCUGNxKBYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629116444, "uuid": "91e2226d-dd2a-4553-9e47-7fbad7d15eca", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629116444, "uuid": "6471f828-6360-492f-851c-0079bf46c458", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116444, "uuid": "ba0d953b-59b3-4e2a-af4d-69484502a7e8", "value": "9996968bf823f79bb6cd767642974947.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cf48a8-fe5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629096906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096906, "uuid": "9f0b18a8-6d32-4c01-a713-9dd086b39880", "comment": "Malware payload", "value": "40d772616c8da3ad402ed9566923d160", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096906, "uuid": "d6b49215-ee50-4f93-b71b-3f1d5cfb5f56", "comment": "Malware payload", "value": "2534d08e389578f03816247fdc2d0363cea45981dca6956a73543639d38877a0", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096906, "uuid": "55ac4897-e61b-4a89-b486-f5ceac1d96bd", "comment": "Malware payload", "value": "a13aff3e714c477f5ff9101c639dfad52b9acfed", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096906, "uuid": "4d87ce57-3cbb-4529-b880-f55064474c76", "comment": "Malware payload", "value": "3dca251066da64fb4fa159a123af2ebc613e8b4ca52c78c3568762b74e130bb6cf5ac0cc953b2c57f8344f78e657507b", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096906, "uuid": "504e5059-2dbc-4297-a8f0-a8fe14ecd14f", "value": "T17F22A011DA47E8CCCA219474B9AF8AEBF6A1E529DDFC45846C88FB7C09A04D343D14D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096906, "uuid": "1f0c41d3-eb2a-42bd-836a-8f121231a627", "value": "192:xrXP/Gd9w022hyrCkF+ilc+DtJiwYtspISgBVfpW1+UnmpkqXy:dXPmhMCkFnf+wYtughW1+UHqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629096906, "uuid": "ca2d1c55-1d71-4ef0-9a43-0126dbe60cff", "value": 10661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629096906, "uuid": "83ffce2d-57ae-4af7-8dc5-ebe2c55e408f", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096906, "uuid": "57b07494-7930-4b76-8d78-f985614c34ae", "value": "scan202108161239015.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9413a10-fe82-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629112404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112404, "uuid": "1da5a34b-3d6f-47e2-9b72-f540f6f2f6dd", "comment": "Malware payload (Formbook)", "value": "ae2de0b0e6acf9a4d009f367c8928e30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112404, "uuid": "a19d37bb-1a26-422a-952d-6bf63b653dac", "comment": "Malware payload (Formbook)", "value": "257a36fdd79cbf165caeda4a1efe458034d670b71060693fdb0d2a1bf0489aa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112404, "uuid": "4b9b687f-43d5-4ad5-af6e-466acb32affc", "comment": "Malware payload (Formbook)", "value": "84269fe071b6b944df79ca09d58fd60bbc2d666e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112404, "uuid": "923681ea-bfbf-4e33-acc2-b04b3dec7192", "comment": "Malware payload (Formbook)", "value": "f491676b0f03169907c7e8615768c9e0c985004b4ca99a93895d70d3dc27a6a3dbea3532d4b9e12e5476b6e55eb501a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112404, "uuid": "b4f366a0-3787-40f5-8bc2-c887a421c78d", "value": "T19EE4E338225A0953F2259277F422EEB0EEF03E522900CD1A46D6FB873D526C2DD9DD5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112404, "uuid": "c2393519-25b5-4b8b-aa52-5b2a1e406eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112404, "uuid": "c273b98d-64eb-4ce3-9f4f-e77916c43e01", "value": "12288:dZLEWO2cRn4QR+1YJp8+wjAcdxjyeFsZgUC5X:7PDonvYH+iAyraZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629112404, "uuid": "1944b39b-fa07-445a-8844-20c83f05fcb2", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629112404, "uuid": "6171c3d0-e890-4508-9607-f7f923e25019", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112404, "uuid": "e4c9b531-21af-42f7-b92b-abc3c42f6a13", "value": "257a36fdd79cbf165caeda4a1efe458034d670b71060693fdb0d2a1bf0489aa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecf939b-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629125996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125996, "uuid": "ba5f8b97-bf43-46f5-a410-ab668efba263", "comment": "Malware payload (AgentTesla)", "value": "fca9568ab29b21020cdd51b45d25f89a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125996, "uuid": "d40ee523-6953-4ed7-9f10-8263e519ce2a", "comment": "Malware payload (AgentTesla)", "value": "2601769cd8fc584d07cf55e4ba7be7d3b1bb45d82e992cee1ec02e4322f8ac40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125996, "uuid": "1815cdea-a46f-4d42-afdf-e131d24838ee", "comment": "Malware payload (AgentTesla)", "value": "925a46b70961e7962d43ed0b6562ef820118a75f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125996, "uuid": "384ad347-dac8-4144-b6f2-5e1e533603d3", "comment": "Malware payload (AgentTesla)", "value": "bab2d5eeb603a213b6349eeee99293ff56a5855f691878f9fd33c1e3d58310621a3c1c87c5ae050188b3ca9fb621b096", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125996, "uuid": "3cd7afe5-2b77-460b-aad2-8de0142679c9", "value": "T19635813C29FD263FC0A6D671CBE28C13B00568AF7121AD5590C7572E532AA5376C72BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125996, "uuid": "e115c7d3-d7c0-4b6a-92ed-a29123d9d3cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125996, "uuid": "3ca88366-b844-43e9-8741-9142bb6e3938", "value": "12288:5gBQStDhvj8oZ/5cR4HTK1K9B035q7biHNen0wDM0nNzhj7RelM:CQKOUyRB35IiHNen0wDvNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125996, "uuid": "ac73697d-2fa0-4512-b261-0491bffb972e", "value": 1150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125996, "uuid": "3c797c73-3b6d-4dde-be16-9edcb59b8488", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125996, "uuid": "a81eb83c-0916-4794-bb69-c582d4dd1e5f", "value": "Remesas Aceptadas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b5a7d1-feb2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629132994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132994, "uuid": "598b6f41-767f-4b9a-98ea-38e4736d1a76", "comment": "Malware payload (Dridex)", "value": "8cd5ef75e45fff0c7c7dedd4269fd1fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132994, "uuid": "4f2ed959-3a62-44f9-9c0b-7ed8c5e3032c", "comment": "Malware payload (Dridex)", "value": "279bb0c424e12f31fa0f75ec47a163b33e3b1ef629a11d1dcb8b6562bb48b592", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132994, "uuid": "313071af-fa90-4f5d-b081-7b85785c4d00", "comment": "Malware payload (Dridex)", "value": "64bffd789eb67917295c2477fc0932b0e885e1d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132994, "uuid": "16b2adb3-1502-4a12-81d9-fb6932827577", "comment": "Malware payload (Dridex)", "value": "4f55108d3152f3a8fc4fdaf7c6b7956e8a909481645a3c443a14e293cc8f607cc277936a00dde70b209f02614d0429a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132994, "uuid": "973b98ad-0d24-41c8-9e27-138df6b90ccb", "value": "T1F73401486A67E85CFD6F7D3C9CDE34786F9ACDAE0910263F21E0A15CEAE03C51C49586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132994, "uuid": "60a76829-ae06-4013-a39a-49b398b34a42", "value": "6144:SQtZbAPPimNA/kjoitkKzf+xRKYILPH/TrUCZil:ptZbAPDNAcMrCrsC8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132994, "uuid": "a44904f2-6e36-4760-bdbb-b9a577945ebc", "value": 251573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132994, "uuid": "ea193ab6-c31f-4da6-9170-f8168138fb81", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132994, "uuid": "1005deee-2689-498e-9a60-4ac88b2d79b7", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_32563.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea299305-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629114526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114526, "uuid": "dca5fb7c-a931-4912-a954-8b33c359b889", "comment": "Malware payload (Smoke Loader)", "value": "b9c0e8858d1d0d249923e3a56b01e419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114526, "uuid": "17f1e9af-bf24-4af4-85de-1b0a109b8a96", "comment": "Malware payload (Smoke Loader)", "value": "28b577b09ddd23494aaa0a19ae4e9219562a80a9176b9cfcdd3bb76a59bf4a28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114526, "uuid": "b1d744fe-5b6b-41b5-a9de-85b20756491a", "comment": "Malware payload (Smoke Loader)", "value": "9ac2c660abb36379f406ce556944a11ee6fdfd41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114526, "uuid": "a53af311-1e80-4bd5-9cb7-fb87fa93cafb", "comment": "Malware payload (Smoke Loader)", "value": "590969216c78c540811ea4c5d1d99b263ac481def32826020fafd5d064ce721707eb6175161c9ef69ad4131b74d831bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114526, "uuid": "aabea891-36a9-4398-9c7c-f41dc8dfd4c3", "value": "T18904BF2D79DFC07AC392313044B38B6C1A79AF21EA53057B77982A6E5F30EF05666349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114526, "uuid": "f2cf7ac4-1eee-4873-8425-ea1337fff9d2", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114526, "uuid": "46730417-9147-4fad-ba45-708611e9f683", "value": "3072:NELTWW/LnTcCJX/hmPBNRgRuc/m/C7IZ7yq:aL1zTotc/m/C7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114526, "uuid": "a746022a-0f64-48f7-bf31-e928947bd20e", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114526, "uuid": "ddd579ad-d311-490f-a4d2-57b3428b24f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114526, "uuid": "955721dc-3747-43e7-90fa-eb4d509e8440", "value": "b9c0e8858d1d0d249923e3a56b01e419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efc722c-fe50-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1629090590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629090590, "uuid": "4440f85f-8b19-48a5-825b-4be447e56125", "comment": "Malware payload (RevCodeRAT)", "value": "a0cb248c9464e9ea4f72ebc7d7807e98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629090590, "uuid": "0160f64d-575c-4c50-b5f6-5a02c20150ef", "comment": "Malware payload (RevCodeRAT)", "value": "28fd0fcdf202f29eaaee33d23939cd5bdd75bd68ee4c7815d4ca4dd2e6a04be5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629090590, "uuid": "ba4d8561-1299-4b9e-ae92-7a868794e106", "comment": "Malware payload (RevCodeRAT)", "value": "d049bc23f0604897e32ac0f76f52677a7c8ce991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629090590, "uuid": "f70cf43f-120f-4ac3-848e-65caf41c3802", "comment": "Malware payload (RevCodeRAT)", "value": "bdbc00ce9ef03e66f0335845b643dd39e1acb3b73d29407cba7a6fcd03fcfdef49f1810d2bf484c2de36a5022a1f9458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629090590, "uuid": "43f363bd-93f3-4d2d-91e5-768c49be1964", "value": "T1D655F100BDC4E0B2CB7538344BB6D0B55CAD1971271286DFA39C697A6F79BD2A83530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629090590, "uuid": "42e91ad4-6eb6-47ea-bef9-b1bc5c4a4335", "value": "82004e82653b7bafbfcf73a18d8cef95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629090590, "uuid": "b3d4dbd2-81c5-400b-a7c3-4fa92b82c671", "value": "24576:3qi8cepZHTsP09VGLHRteRCVdjoWfHNcL9NTYV82qU9tUk+MPAnh7wr:3EdTsPHuCPoQtgNTe82vhnPRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629090590, "uuid": "e7a9af3e-73c3-401b-86d6-ae96bf2053ad", "value": 1322252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629090590, "uuid": "15db2afd-a01e-49eb-afa1-1e99bd12c2af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629090590, "uuid": "96f0d1c8-1ea5-4713-a86b-9250a81f0f77", "value": "OUTSTANDING_DEBTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ae03d8-fe8b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629116212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116212, "uuid": "e52b6c50-bb61-49bc-a2fd-b658231f661d", "comment": "Malware payload (DanaBot)", "value": "9426fc850a62a8c668645ff60fb64ff7", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116212, "uuid": "a76502dc-6497-4b17-a47b-b0517fe1888f", "comment": "Malware payload (DanaBot)", "value": "2a3dfad85e59e53144c3c05413e16939d8c5bf194cd00ba4e2ca4feddbcca2cb", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116212, "uuid": "4bfea6a5-4c69-499b-bfb1-0d42d66f7928", "comment": "Malware payload (DanaBot)", "value": "a34ae42b06ff30694ea514603ca19a34e3a3170c", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116212, "uuid": "cf8ca90b-656d-4a20-bf83-be3f90637502", "comment": "Malware payload (DanaBot)", "value": "284cd096ea3a83fff05c940a9a8eeba074c805d567eef9d7b6a8e3a376c6ca0b5a57234575a9d9b71f465f7005f61bac", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116212, "uuid": "e239bb15-03f4-4f48-877a-3192dfe95049", "value": "T14235236536D2D73AC42211F080B0E7F52DA57C70F21506972A3A7B2FEF76AD170A931A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116212, "uuid": "c191da0b-575b-484a-8f68-bccf78fad602", "value": "1a43dad8615b89dc6e5d071c17cc8026", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116212, "uuid": "b19db22d-e5ae-4b66-8951-eb209db716f5", "value": "24576:xnWzJ72qkIwwaJLbNwfiSdaijHShgY1VOYK:EzJ72ydaijy6oOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629116212, "uuid": "38821f68-c28e-41c1-b68c-038e9784d8cc", "value": 1123840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629116212, "uuid": "99e6711d-4e49-4906-8388-7dc8676dfbe6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116212, "uuid": "9926a929-17e8-4cb1-b71b-e9eaa62a9181", "value": "9426fc850a62a8c668645ff60fb64ff7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3304eab-fea4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629126970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126970, "uuid": "f6a326f6-a1fb-4828-bd67-14f48f68610a", "comment": "Malware payload (AgentTesla)", "value": "c2942fea81a23e2d054b7002d0919e69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126970, "uuid": "b579208c-ab8b-48f2-b49a-e479ba501f9c", "comment": "Malware payload (AgentTesla)", "value": "2a4ec1571e2c29c01f4a8edf3f4d42c43ad68791b689424609e6cda7994d0a7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126970, "uuid": "77c1ce99-b039-4a59-9c5f-6a5772890cd1", "comment": "Malware payload (AgentTesla)", "value": "f93ffce99638408a4c29625d77b52de0fb0b86cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126970, "uuid": "8cd0cf2b-21c7-41b3-8f02-1235969e4ab3", "comment": "Malware payload (AgentTesla)", "value": "338d4d064b2ce03c8a6ae27a1ab8a223db65b2df42b56514989b9e874d6567fe8cdb45823c7a9dcf51d543483e5e2a06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126970, "uuid": "0140511e-3a79-4639-aea3-fef4791bfb75", "value": "T12B45D73915B82B27E079E369E6E44417B3E0985FB225ED59BCDA03E70206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126970, "uuid": "98b0c89e-a0e4-489f-9a36-00205058b244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126970, "uuid": "d26c8caa-3b5e-4fb9-a9c5-5df51969434b", "value": "24576:qYpN0aPFYlblhBVKlLVsqrLzlXlSBEDw:nPy11VyPrLhlNDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126970, "uuid": "5a0430a3-35c7-4664-92a0-7a1c07c42146", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126970, "uuid": "901e4500-70a4-44b4-bd29-cdd9af6bd677", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126970, "uuid": "d4e06937-bcbb-4b7b-a64c-1f5b63ad3a20", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a43e3e-fede-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629151830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151830, "uuid": "dc07149e-cc8e-487f-b1ae-742937af17b2", "comment": "Malware payload (Dridex)", "value": "eaac64f0338732ec1e4764fb2aef85dc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151830, "uuid": "8c1fa6aa-9ec7-4722-bea0-77a8c4883f2c", "comment": "Malware payload (Dridex)", "value": "2aae13b899d4d2707ffdd0fea10f1c1208aba809d118a4b32a94b4af238bc3a2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151830, "uuid": "26a84101-1e57-4fed-b0a1-41af219cdc91", "comment": "Malware payload (Dridex)", "value": "4560f8ac6ea2843dd5926232012b0713117c88c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151830, "uuid": "2c97c1d3-b31a-440e-ae37-8db493bf6c50", "comment": "Malware payload (Dridex)", "value": "db7e6a2c9cb0c46f83383e0a7e2bb0ff46231cd98aef1092171e05faeaa0e16a252ff7b523e99081a8aebd51f5cb37c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151830, "uuid": "f5bf1d52-92dc-456a-bb76-c6227a1ec05f", "value": "T1414401592517EA9CFA8F7C3E8CAF10B07F8DCDFE05106A6F25A1A61CE5E03D50C25896", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151830, "uuid": "4086b394-1f4b-4462-9f1d-eb214e26e46f", "value": "6144:SmtZbAPPimNA/kjoitkKSl6pt5B9L98awPelc8zC:1tZbAPDNAcM6SlS3L9zlc8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629151830, "uuid": "9e205b1a-d77e-4e82-99b4-e1c89777e7a6", "value": 253555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629151830, "uuid": "d8bdc4d0-c2ed-4298-be10-d469222bba37", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151830, "uuid": "9e1675a5-6384-4e28-bdc1-15f101e7907d", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_7_7071798.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370cb15e-fea4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629126681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126681, "uuid": "f2baff54-eff5-4470-b70e-c23059930256", "comment": "Malware payload (Loki)", "value": "99ff4832b130f89d3a8b66534faa4621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126681, "uuid": "377b83e2-a0cf-4aa1-85e9-35e31f8f769c", "comment": "Malware payload (Loki)", "value": "2ae2e083aa019b3afa73856db6ef587945f193df698e40da2047b1bb2ee0f7d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126681, "uuid": "392edb35-e235-4c7f-8b3c-e0f3063c646f", "comment": "Malware payload (Loki)", "value": "e16bd41244185f60ca0b3a1b6c973d41031b4370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126681, "uuid": "703d4062-78b2-4f3a-8dda-ca6cd6212ea9", "comment": "Malware payload (Loki)", "value": "d4222fe73960d05c94ad45d905be6aa5a15aa4bc9c7209d5b4e5a4bdff1f9e1dd2ae7427b66e03f540c2972d3fe1c5c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126681, "uuid": "7c257a8d-d752-4baa-9952-eab3f231b98f", "value": "T1A035D93915B82B27E0B9D715E6F14447F3E0A45FB225ED59BCDA43AB0206E4266C333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126681, "uuid": "58dae2df-1960-4aa1-b4aa-1724a7bb7838", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126681, "uuid": "97fab345-e1b9-4e9f-ad6e-67b0f52b8562", "value": "12288:4nf+GtZ/1k9jaOS1hFYJDc9F3nC0Py3gAhlIalhByn0DbRDuFoA/ROEwtbvnDP/4:bm1kFS1hFYxblhBj8FStbPO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126681, "uuid": "26f3bc33-ee9f-4d6a-9d5c-3c1470589cfc", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126681, "uuid": "23df3df2-6712-4811-a218-cdec5a8b0a65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126681, "uuid": "ab7c55f9-d31d-4879-a60e-aabf974149a2", "value": "Ref. #20880 (PURCHASE ORDER AND CONTRACT).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cb3370-fea9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629129043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129043, "uuid": "8278304c-56d4-44f8-818e-883995f000c0", "comment": "Malware payload (Mirai)", "value": "7e2dff0c4516011b56b750c73d784689", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129043, "uuid": "1b654659-8acf-41c0-9370-dc6de07436b7", "comment": "Malware payload (Mirai)", "value": "2b46452ad26063ef3b5a9434975ea1e778cd669ef38e69d1a8a12b49b390effc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129043, "uuid": "8c87c235-32a5-423b-b0c5-4a9ddfd751a0", "comment": "Malware payload (Mirai)", "value": "1696be8d4b9858e5a1edc67b7de3b6efdeda4eea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129043, "uuid": "feb773c5-5b6c-4acb-89c3-31ab2ff006b3", "comment": "Malware payload (Mirai)", "value": "ece5199b27bd279957f1d52ce8f9f53b208175022b3b5d415073e177c9a922f5670d989dae3350b6da96453d4679f4c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129043, "uuid": "8e768613-1147-419f-b27a-30ca1706f075", "value": "T13D53B70E6E219FACFBAC873547B74E24964833D626E1C545D16CEA001EB034E746FBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129043, "uuid": "06924fc6-92e2-4f43-8858-fae6218f2a01", "value": "1536:MP5gEBXMVKz3gz3igz35w2Ks2RaYyBPGllE0qK4xj:IgEBXy83lE0qRxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629129043, "uuid": "fbfd0497-daab-4c22-879c-74b7a3fe39b1", "value": 62128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629129043, "uuid": "44bacaf7-9d9f-4427-84da-6c2e58452b85", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129043, "uuid": "5116a295-beab-499f-9709-204238201ff6", "value": "7e2dff0c4516011b56b750c73d784689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1340cdc8-febc-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629136929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136929, "uuid": "a78b3cf6-9571-4f5a-a30f-11361a951932", "comment": "Malware payload", "value": "737fcc361993ff90106cd58964a02a40", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136929, "uuid": "0f14b221-9fc4-4b01-9138-384399f51942", "comment": "Malware payload", "value": "2b756d0e28c6dc4ed3989fdf7044ebc02652f331242e4d5981a165b05b6e39b8", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136929, "uuid": "d51356ab-562e-412b-8393-f723c4042fe0", "comment": "Malware payload", "value": "d2acd84a5926dc0ab714b87b319e923e0e90c34b", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136929, "uuid": "8219bae2-e6f8-4d33-a6c4-e9581bd9fec2", "comment": "Malware payload", "value": "9918e5562b91d7251224e66a0fef15f6c1365e045536e71d7641dd292ee9da165ec6aa8898fa49f7e21a00f329d4ecc7", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136929, "uuid": "498e637e-1bdb-4b76-ac2c-4e3c6188c61a", "value": "T1595512A474D40FFAF87D1C700446462FA9EAADF095884701AD9C7A01DAFFD6926F8B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136929, "uuid": "2bc32dba-759d-416d-a1a9-1254a3f42a44", "value": "24576:jCM9HVHOKPlA8mNpj5EJZ03LGGvvt63/TF0QXlXcV1vgSa1jQ7:OMBgK9kNpjky7p9w/TxZcKE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629136929, "uuid": "c502313a-d893-40d3-b5ab-1c7388abdd78", "value": 1371000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629136929, "uuid": "37410bad-472e-42e6-9912-ee660be402f4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136929, "uuid": "5657bd14-f429-4649-8c0c-b3c1ef4672d7", "value": "x1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecc988f-fe84-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629113031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113031, "uuid": "ecad8c9f-fc9c-4844-8fc8-98b5fa9f30a0", "comment": "Malware payload (Formbook)", "value": "6bca65813eeda79ba5ff4674fd4f831b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113031, "uuid": "65c9c679-ecd0-4580-bb1a-8daf2b5bb4bb", "comment": "Malware payload (Formbook)", "value": "2c365b6985fd96e0f9596e0e17370ef537d786473e490dfb144ade8fedc5f2ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113031, "uuid": "69140e72-2130-4eb0-bf72-623f12e19ad1", "comment": "Malware payload (Formbook)", "value": "b2eb4ec39716a2ee523372ad443df85f54ba1fc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113031, "uuid": "b383e349-7930-4c2b-bec3-86e3d785ebbd", "comment": "Malware payload (Formbook)", "value": "ca3d68f1c68c921725d8bfe6a50bd5d47c587884b11d290c57c2ddbc8ccd7666b9567a7c26e1479da1d038dc9c454651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113031, "uuid": "d8101364-535a-4f4f-ab6c-ffdf1041514a", "value": "T1C545E73916B82B27E079E369E6E44417B3E0945FB225ED58BCDA03E74206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113031, "uuid": "da3beaed-4678-4c34-8754-48c181b479a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113031, "uuid": "577bfde1-f486-4f0e-9311-a1aabcdbe30f", "value": "24576:ArFxb7FYgblhBewLhuXmXGrcWx/lND6hEhd73:Kyc1ewLhu1rTNNDWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629113031, "uuid": "cbd6b39c-fb18-4bab-bf49-6ef813a087d1", "value": 1189888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629113031, "uuid": "54f8049a-ddd7-48a0-a733-ceed0a9d223e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113031, "uuid": "56986846-82b8-4f5e-aac3-c062ee174f54", "value": "Confirm received PO 4500640396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280ec373-fe5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629095303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095303, "uuid": "085bfda7-894a-4102-ac87-566950c090cd", "comment": "Malware payload", "value": "bc9467a1bcc9b681ac29408f29d74acb", "object_relation": "md5", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095303, "uuid": "b8734910-522e-48f1-8113-3743a7a3125f", "comment": "Malware payload", "value": "2d9575a808585697589ce697312d6dec8e9c4ac98207694c089dc05892097396", "object_relation": "sha256", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095303, "uuid": "b0726729-5488-44b3-914a-476654ae59ac", "comment": "Malware payload", "value": "d4dc8e4286dd9deccc6662c3e0166228e9140802", "object_relation": "sha1", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095303, "uuid": "163ea56e-8557-444a-93ea-e9d2c24e376d", "comment": "Malware payload", "value": "1e880d1c815d131b605ce87cd13026d4d827adba8d6dc0fae3d2a78c236203ba4e69cdf0f5741983c8437cdb04f13295", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095303, "uuid": "2f929dab-ca24-4fa1-8d51-86c36c3b1ced", "value": "T1E5E3120A88D2D47EFA8FDC97DD88DB403D1E8AF7D54071FD28528A72DEB226A3575021", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095303, "uuid": "187b1203-d964-4a3f-b134-75c2db286c89", "value": "3072:63XnPrUudo/6v8HQkDwbzLgKQV0qUN+w3gF3MhJEMEoZn+0t:cI/6BzLvQV0hUE3EKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095303, "uuid": "389c553d-8c43-421b-9755-d7891b3796ed", "value": 146858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095303, "uuid": "6e599796-8575-4fea-abeb-866533979c47", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095303, "uuid": "f9f03e7f-6069-4961-8c9c-1129b144a563", "value": "Bank details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3119b39d-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629104767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104767, "uuid": "c68584e2-61c4-4542-8e61-459a258c0ae3", "comment": "Malware payload (DanaBot)", "value": "ac6cf4bd1a554f44a2ce5542b30e6cc3", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104767, "uuid": "24c0c9d8-d99d-408d-b41c-dffadcd32e04", "comment": "Malware payload (DanaBot)", "value": "2dcd85215e085d1ed46a1f8840605bd49264096dbbd0e840c12607a8c0aacfa0", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104767, "uuid": "0a7f9445-fc17-4e1d-9eaf-9f76c4ecc2c1", "comment": "Malware payload (DanaBot)", "value": "cdaaf79fc8cd25d4ae000ffe6f7a7d0c7324710c", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104767, "uuid": "99619841-a2c3-4ea7-9cd0-ce12b28e25cd", "comment": "Malware payload (DanaBot)", "value": "f561fb710f460dffaaa387076b4be9c47590075c6e0cafa69aab4fc97c3660a398deaa58503cbb3ba84fb1d6e369eb2d", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104767, "uuid": "b62f3798-55be-4341-ba81-9b77ab4e085a", "value": "T1ED35232E761FD173C39674B00477E75C08E3AF2DE753297A4A94325B0D20FB299AE225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104767, "uuid": "8642f2a4-ba05-4d96-accc-c6cefe895d80", "value": "675f985c31bb43cb925f7664d8fe06b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104767, "uuid": "250fe972-8aa1-4c38-a047-3be2cbb9c2f2", "value": "24576:uF/GzdqS2G86ayfIR9V6P+r8QHuHHanLwE/7U0+9jrD90IYO:UGxqS2B6aWU98WrIH4UE/7Ufd3YO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104767, "uuid": "4a28f91b-8d51-4e67-b0c4-d5cbc9700f4c", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104767, "uuid": "9a722667-ed5b-4298-a45b-48a589929975", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104767, "uuid": "d77ac170-d0ae-4f44-8c83-8d14f1b8a12e", "value": "ac6cf4bd1a554f44a2ce5542b30e6cc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae10e0c8-feec-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629157805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157805, "uuid": "cd3ab529-6703-47bd-9a94-8d34b5847eed", "comment": "Malware payload (Mirai)", "value": "34d2384c7e1c754ac4a0df6811602b72", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157805, "uuid": "6ba21bb5-50f8-4a41-8d3c-bcdeba4064a8", "comment": "Malware payload (Mirai)", "value": "2dff0a516fcdb159f0fb92949fecc42c31ab5e5a13ccb80e62b7a1c1fbd10464", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157805, "uuid": "d385b56e-a9d2-4732-8e88-16ff3510eb7f", "comment": "Malware payload (Mirai)", "value": "cb9a47b4c238e064af615187f65256ac739bcac0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157805, "uuid": "89d5be50-80dc-4505-81f4-f38f01e42f38", "comment": "Malware payload (Mirai)", "value": "d966fd69420b696b95b9865c029499502c3fa31c99a54339a28f52ab2863b8017627fb718d321351d6f0779f8054a6c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157805, "uuid": "562ea7ab-d2fa-44d4-9af0-b53c68e5c95f", "value": "T1C1534AC8A5C3E5F5EC001D79307AABA1AA73F53F2039ED9BD39E25739942243E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157805, "uuid": "574f13be-86d0-4d01-83d7-657bfa8b4f8c", "value": "1536:b5VYYpXIqVkxmxRvXMFnKiaujGKO18Hq6PWRORu0+j/iMAm9:diYpROxmxhXMFnKlCGHCHqlmu5/uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629157805, "uuid": "9c3aadd6-ebf2-47b6-8d8a-cba03286d96c", "value": 63664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629157805, "uuid": "19854f65-582b-4b82-90e7-25a42e331f30", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157805, "uuid": "2a0fe536-aeb7-41f1-911c-848a5e4404f2", "value": "94VG.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22700f9-fe5a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629095132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095132, "uuid": "8783f039-9540-4a91-ae6f-3a9cafbe5e7f", "comment": "Malware payload (NanoCore)", "value": "42ea22b3d6d397e534023a4a395b1acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095132, "uuid": "6f1f7ba5-6b5e-4af0-8543-31ad2e510d85", "comment": "Malware payload (NanoCore)", "value": "2e98a36770699ab33909e12ff2bccc7fa0f2d1eb13a8456b0989f8eda2c5f7eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095132, "uuid": "082874d6-7262-4d4d-96b8-7945be921a7f", "comment": "Malware payload (NanoCore)", "value": "e0f915d2bb5433b80500d4a760689bfec2536739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095132, "uuid": "fe5398b8-abcd-4a29-a94b-4b6d8a2ec271", "comment": "Malware payload (NanoCore)", "value": "b91817a78a082c069b5cab5723aebbce6e5d0589cc61cf52d7fe7da12976504700b44e4f62c3fca4c6c03495aa4de7d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095132, "uuid": "e0febbc3-e6f5-43ed-8c26-4a1618c65624", "value": "T15E35BE6C3140B5AFD13BCD36C4580E55F660A9A6E3CBC613E0432959993E3AB9E443BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095132, "uuid": "7f8c9f51-5d73-412d-9a43-6446fe3756d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095132, "uuid": "8a4de822-d859-4bf8-a515-27391c363e65", "value": "24576:aDiD6LsZp+aZktTx1UHHPbQwrrMyKkWgf:aDwlp+aGxlMgyxW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095132, "uuid": "5c84d549-708a-4296-92b7-68fdb9e89a7f", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095132, "uuid": "a3c8c63f-c9d9-4976-a302-7de0a8f62278", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095132, "uuid": "85bd4b6f-1c18-4ae0-9ae0-ceac716b0c75", "value": "PO-345683.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ff4354-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629114538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114538, "uuid": "d20fada7-91e4-4a5a-afd3-323c87c727f2", "comment": "Malware payload (ArkeiStealer)", "value": "1ff82ecfed07ab1ab21da5700ac72df3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114538, "uuid": "07b9e507-0387-4805-a63d-66f338aa21fd", "comment": "Malware payload (ArkeiStealer)", "value": "2efc1212893126800e4df34417ef4190515af997935e0eb6a13293406d2983ab", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114538, "uuid": "e04ab99b-65f4-42e3-9484-ef8a37daa690", "comment": "Malware payload (ArkeiStealer)", "value": "858455e7f4b4208278ae8fb62f42bef572472866", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114538, "uuid": "9c7e2e4e-e869-4410-9eb7-cd9d36a66e8e", "comment": "Malware payload (ArkeiStealer)", "value": "25f9b5ec79bff174edccb0cac4fc8d8233594465d42087500ae32196fc8382501ca352859af8cf3f5bf28e6fd202a09f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114538, "uuid": "d2830d35-1b29-4e05-9f16-c145591f4383", "value": "T1BA04BE2DB98FF072C791753280738FAC5E699F20DA53057B27982A6B5E30EF05626349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114538, "uuid": "508c5ca9-4bb1-4f18-9a2d-06746849ac46", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114538, "uuid": "db917554-d609-4a73-9ba8-ba552f65446c", "value": "3072:FELTWW/LnTjAUKJOEDhPXKBNRERVc/mI6CZ7yq:CL1zTjRKJOEDs6c/mI61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114538, "uuid": "123aaa45-40d4-4d70-9a3c-a3cd1ef40fdd", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114538, "uuid": "7dc11703-23ff-4576-9730-40e5a138458a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114538, "uuid": "a39a7585-61c1-4191-b32f-be8bf9bfe55e", "value": "1ff82ecfed07ab1ab21da5700ac72df3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5097bbd6-feb2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629132737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132737, "uuid": "f696285b-d461-4816-9182-9914e1acecb0", "comment": "Malware payload (Gafgyt)", "value": "eeeae6cd148f652ec2d1707fcd9b75fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132737, "uuid": "7f6d4ce2-8391-4902-98dd-c2d05e0ca557", "comment": "Malware payload (Gafgyt)", "value": "2f27d956daba0ab8929402ec637ee8317c3f061ffd1e5f6e6ee1800c06eb72d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132737, "uuid": "1599ef15-3da6-4a0a-8684-6d068e083e19", "comment": "Malware payload (Gafgyt)", "value": "8e49a459c342041f18e8310cbc6b89762f8e04c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132737, "uuid": "b3bc524d-f15c-4c27-b38e-f2f0ab58a432", "comment": "Malware payload (Gafgyt)", "value": "f2c7aab0834219981eba46ecf8f58fff223d86d4ffb3cf771430b318c29da82e159f0224d899f357cf18dd6346d02624", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132737, "uuid": "d54101e2-3495-4245-b262-11aa44351859", "value": "T19E833C06E743C6B3C84307B1029BAA664931FABA1E269F49F36D7CF4AB138C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132737, "uuid": "e644e271-558f-4ef4-91a2-53e9bfcad7f9", "value": "1536:wBdmZwZVa4FJ3emC8AnzGpWHMvVyRtzemF+wVOz+sXcfW7k:9ZwZVa4P3emjACcsM3emEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132737, "uuid": "213ac2e9-8a85-4ce4-9b71-a4f364d935ab", "value": 85001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132737, "uuid": "9096ef2f-fcf0-4c8d-96f6-af9aa44762ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132737, "uuid": "d0795322-de5c-4685-8823-55a1546b4094", "value": "eeeae6cd148f652ec2d1707fcd9b75fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9be4953-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629134256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134256, "uuid": "3a12a834-c100-4bb3-b284-0d9044b0f874", "comment": "Malware payload (Dridex)", "value": "ac01655c93b0e07eadfa2c8dc5d436bb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134256, "uuid": "6da45a41-d6eb-4a9f-898a-0a3e09182e41", "comment": "Malware payload (Dridex)", "value": "2f359226395840e8367df9f593430bf94358172b4ec832a493bbc66c93f74095", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134256, "uuid": "8d435c05-4007-4fd6-9aef-e67e4a745865", "comment": "Malware payload (Dridex)", "value": "3da449447291121191cd82199118702a2f944f7a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134256, "uuid": "48c70d7c-5157-48a1-9c6e-fa7ea9704234", "comment": "Malware payload (Dridex)", "value": "8e11c0af2c07da8c6ee96ba3c0f1b4a434bd584f48164b3a3884a1e2aa48c7d873a3ef11b695fb4a944d6528b1c9fb7c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134256, "uuid": "3694da14-265a-4f7d-be54-1555444bccf0", "value": "T19D44F0506A93EA5CFE9FBC3D8CDE25B07F8DCCAE0900297F51A5B61CD6E42D20C25499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134256, "uuid": "2014ba5d-58f0-41ab-92e1-0625d4d681ff", "value": "6144:SetZbAPPimNA/kjoitkOes4Otx/EkqB+JbAK:HtZbAPDNAcMyTtab4kK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134256, "uuid": "73f17a4d-bba6-4760-b11b-013a4589caab", "value": 255264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134256, "uuid": "f770f911-330f-4f09-9cf8-cbe4e1413683", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134256, "uuid": "3f3eec8e-fa87-4231-a971-1667262c6adb", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_8_670779.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c43538-fedd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629151409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151409, "uuid": "06c77ca6-be05-497b-9f9a-bf576d4a5d47", "comment": "Malware payload (Dridex)", "value": "57531fd212a58f0cc07795b332f965ef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151409, "uuid": "43f9a4ad-ac69-4086-88c4-10148eb49585", "comment": "Malware payload (Dridex)", "value": "2f777e87f4da3320f49a813c0e80268cd486e6a0a116c544f1253311713717cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151409, "uuid": "5f55cbd9-0a99-46b7-ab40-7daab32a7305", "comment": "Malware payload (Dridex)", "value": "4b7d30a340fc6ecccf5e12f547ea9d73f5a6935f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151409, "uuid": "4bcda9a3-389c-4f6b-a5ea-c2dec6013a08", "comment": "Malware payload (Dridex)", "value": "7a31fc17648da5cb02c8db2d1ebfe536c74a68f115883f43c42113ab8e0e9bd61e7c8a3f65a788f96a8d698da94769fa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151409, "uuid": "fbcb8742-0335-4688-bd4c-53944d3a7172", "value": "T12C4401516A57E89CFD8F7D3CCCDE29742B99CDFF06001A6F10F1A65CEAE02928C19496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151409, "uuid": "cbb33264-05a0-461f-a234-33edb265222a", "value": "6144:SNtZbAPPimNA/kjoitkimBcVvAe+7JqLiY5KYqfJRO5WWXb24plU:8tZbAPDNAcMSGMG7gLilhfrOoWXb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629151409, "uuid": "f3030d42-ddb6-4742-96c8-23b923cf1f6f", "value": 254088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629151409, "uuid": "53e2eefd-b672-493e-82c3-be4259d9c8cc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151409, "uuid": "d09ab4c8-5c36-4187-8d55-0274d2fa0f2d", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_8_00402.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16fa603-fe96-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629120981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629120981, "uuid": "73604d99-4f76-4706-9ea7-e8f5fdf435f4", "comment": "Malware payload (Gozi)", "value": "7ceca82e51c65027b9f5898bc20f9cc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629120981, "uuid": "2d93657f-e898-4da3-843d-295cbdc1a1f0", "comment": "Malware payload (Gozi)", "value": "305b4d78909b1c91af81359cf9eadb3ebb286cbd0539bf20189c98af65509242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629120981, "uuid": "0e96e341-1eb2-4a41-8c6b-7d9038c759c0", "comment": "Malware payload (Gozi)", "value": "c547998124f9baf51aac77f878d63975516f3625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629120981, "uuid": "3c473741-f9a0-4cff-b59d-d790f2347637", "comment": "Malware payload (Gozi)", "value": "3bf76148ad7c6026442d65222ba5c0d8a9cb8eb222ff1ed03facb8b79e3280805e62ac09725a26b86db7784bb68cd408", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629120981, "uuid": "3c72794c-e74e-406c-bfbf-ee4fa2e5263d", "value": "T168448D3076A0C035E5B702F499BAC3BCE5297DB15B2051DBA2D52EEE56347E8AC31387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629120981, "uuid": "d51cea00-7710-47af-9026-1ddd66594deb", "value": "7516bd35cc21aff34ab4b704c018e246", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629120981, "uuid": "ee6f8b7c-383a-4c05-848d-dbd44ad0d2eb", "value": "6144:Occ9NHV+aVVxiPMFSyVhcOhk5ju147FwPp3mZVG8ws:m9ZV+avxiPMaOW5wPl0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629120981, "uuid": "639435b2-bab2-482c-a033-f83d18d4b7ab", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629120981, "uuid": "03b285b2-46f3-491f-abcb-519b99eab018", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629120981, "uuid": "a7af354c-f92b-4b34-9697-822f5fe0284a", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d65891-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629114252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114252, "uuid": "decadea3-fc64-4f72-bd44-e5011938710e", "comment": "Malware payload (SnakeKeylogger)", "value": "82b51cd131dfd15563e352b5ee83163c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114252, "uuid": "d2aee098-357e-4090-b022-90157fbcd28d", "comment": "Malware payload (SnakeKeylogger)", "value": "31b5000cf78635731bfe23c558dfe5b7f5319ee14fc34864a51e6cc125647a41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114252, "uuid": "ee803308-e800-4a50-8ea0-cb7ccbd62179", "comment": "Malware payload (SnakeKeylogger)", "value": "72b3d1a8808cab246e32fe657e840189d3ca7380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114252, "uuid": "7425c141-6d08-4ac2-abaf-3ead0ade417c", "comment": "Malware payload (SnakeKeylogger)", "value": "ecf4a4676423d4da201ac02de4a0961dc8717e429486c68bee8a0230f8a36afda29e29502c5c2919ed986cdf9e8a8cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114252, "uuid": "7df091a9-fe84-4c13-a874-38cabfd85668", "value": "T15935D73916B82B27E079E365E6E44417B3E0A45FB225ED59BCDA03E70206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114252, "uuid": "ad1e7165-0e24-438e-a556-c8d278d5cb9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114252, "uuid": "15c6377d-06cd-4ae2-804e-cdc4e3e00813", "value": "24576:07ATQeuFFYTblhBUunsif1932vJafiiKhxxs:Qyf1Ur073BfiiKZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114252, "uuid": "a50e5b9e-9880-4887-ac93-4f2423beb77c", "value": 1143808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114252, "uuid": "1893d5b1-f1c3-4318-9459-be6960fb9f23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114252, "uuid": "02ca27bd-1895-4aac-9699-0614df7313df", "value": "SecuriteInfo.com.Scr.Malcodegdn30.15691.8759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0fccde-feda-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629149934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149934, "uuid": "b4294255-c15f-4ad3-9ec0-cb1ecac2c2e5", "comment": "Malware payload (Dridex)", "value": "90d3428a753f6002f128cff2c5873e97", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149934, "uuid": "4c6f374b-f67d-44a8-882d-f6a57348c248", "comment": "Malware payload (Dridex)", "value": "320b29113d43b32caf98583c26f9a75938f7082f962138cb5f6a8cd2030b11f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149934, "uuid": "82be7fbd-ee9b-4fab-89cc-d84bbec07fb6", "comment": "Malware payload (Dridex)", "value": "86338a162253418f901f1e7cfe2a4b9c35538a9f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149934, "uuid": "9b6cf166-439a-41b6-8c78-3621547015cb", "comment": "Malware payload (Dridex)", "value": "c08b8d1b4aebd40a27a6347b19a1e49f1140b8d287258cc0b68a68de0dc52518d86f441be65cb85ba18bce3a13ef3608", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149934, "uuid": "3e41cb77-8075-43df-afb4-394182cc4af3", "value": "T17E54022645B3E128D6EA9039CC9B0FD913B54E7B15807B6AF2F5920EED09CF321561CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149934, "uuid": "5ef38e39-e030-491a-9f40-39eaf607c4b4", "value": "6144:SzNSLcq+YXEsL2sMtEuYcM5CuOkh3ajXTbpa4ojZQ7la:oPYXEsCsMtElcM8uHhWXXaZk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629149934, "uuid": "288ac4b1-60c1-4bc9-b8e3-105d37704a74", "value": 290057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629149934, "uuid": "9e1ac8d0-217b-45c1-aae7-a305c56212ed", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149934, "uuid": "f0fe2e73-2356-430f-b2c3-92307c26b63c", "value": "taxve_47630489_20210816_940338_0298107065.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f02550-fed3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629146995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146995, "uuid": "31ef217a-e073-4944-86f4-18ee31f63850", "comment": "Malware payload (Dridex)", "value": "f36e8e47e372b2a13c3cefe3f0811639", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146995, "uuid": "5d63dbe2-b48a-4c43-8588-bf58ce5d7037", "comment": "Malware payload (Dridex)", "value": "32b25536a8d4a69b50e2a07589dcd3d087e0cf6fade720a60c5ccf4aeba00039", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146995, "uuid": "bc006e90-6ca0-48e2-8972-1b33a0f45863", "comment": "Malware payload (Dridex)", "value": "1c950cb74285f76c74a0be15227d0768482522ae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146995, "uuid": "6e2ebbe3-d5db-4a55-af46-7f9202750410", "comment": "Malware payload (Dridex)", "value": "56ea90a18ecebc719b44d2f7ea0c4ec2aafbb3fbdba7daa3d265cf606d67a3c06777e2ed9a3142b90c478627b23ecf53", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146995, "uuid": "ff90bc2c-871b-4e8d-bb85-acda15a96638", "value": "T1D64401445A23D95DFE8F3D7C4CDE2DB96F888EAE050428BF91F0A91CE9E87E51C05086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146995, "uuid": "f82c346f-1471-4810-8abc-dd5e6033b1e6", "value": "6144:S6tZbAPPimNA/kjoitkpXfrK5L2agpzdQzCUh3kzN0cb6QlQ:9tZbAPDNAcMpALMpZ7USjVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629146995, "uuid": "f23ae955-c568-45dc-b882-6f1c9801a7de", "value": 273040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629146995, "uuid": "0628391d-f2ab-470f-8b6e-393b1e1ebc65", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146995, "uuid": "70c4e8ec-4157-44b6-a635-f45d292cdf5f", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_3_666705.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1ebc9e-fec4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629140650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140650, "uuid": "345c82e2-8878-4d34-8b9d-ddb1bc5934b9", "comment": "Malware payload (Dridex)", "value": "a334fd5d18e6af84ab7bbba7e451f391", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140650, "uuid": "1bfd8b07-a860-408d-a332-fb6e212996bb", "comment": "Malware payload (Dridex)", "value": "330d517d58cc3665bb895d7f4339258ac5c626b1aac9a3e9707304af3e372762", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140650, "uuid": "3fbfc9da-89a6-4c22-9d3e-c3cfb64116e6", "comment": "Malware payload (Dridex)", "value": "6dec051a16b2bd4989160ad784c437cc4f5602e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140650, "uuid": "0ab6606b-4cb2-4735-9fc6-4d60935af6bd", "comment": "Malware payload (Dridex)", "value": "a414f535f328c5623d22e7b915ffdcc80f78ecd736d8678de189adce3026a6e9b1ccf8b4fe1b8e6a6681f793f7788090", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140650, "uuid": "635446d1-5383-468e-9cde-79f50c61d9a4", "value": "T1B734021584B7F228DA97B03BCC9E0FEF23B16D2B0590AA17E7E5F10D5F19DA32160586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140650, "uuid": "5e958acd-6e4b-4fc8-9ea1-606f4c6a59e0", "value": "6144:SkNSLcq+YXEsRuhGsk7O+kGGWO8xplth7p:XPYXEsv9O+kGwubp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629140650, "uuid": "0968de10-0288-482a-a394-c463e8947f4e", "value": 246877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629140650, "uuid": "0629762f-74aa-4016-96bb-b42bb127397e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140650, "uuid": "51b1b5e8-137c-4741-9314-74edd24bc95a", "value": "taxve_28580446_20210816_91643788_45763.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db4943d-fec8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629142127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142127, "uuid": "660466d6-b0b8-43aa-adb9-bd8e4ddb51fc", "comment": "Malware payload (Mirai)", "value": "d748bbcc62cb2e0fa4a14d95ff8bf174", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142127, "uuid": "7d77c262-84b8-4f25-a209-4e420409461c", "comment": "Malware payload (Mirai)", "value": "3320d0c36d0ad882e50e16aadeccd9b8b8fb1ceaf6a0ffed539207412a5727b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142127, "uuid": "2b3a126b-cdaa-47f4-b434-c97e7f2d3330", "comment": "Malware payload (Mirai)", "value": "293a1ca471bb36fc627e83ff6973e98568f06b1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142127, "uuid": "b005f4dd-c25e-4417-a699-705ef4327e7d", "comment": "Malware payload (Mirai)", "value": "9fa264880d186185ef0df524d112f76347cea4ca9749487ba80154293cd7cb6434cb73118965221c0927083dc513f92a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142127, "uuid": "93c2c1af-47c9-487a-b056-b723a2f52fa0", "value": "T195338E61C96CAD44D25C42B1B9288E785323EA05EAA62FF54A8BC3519407FDCF12E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142127, "uuid": "86be6f18-38db-42a2-a509-f5b35bc882ec", "value": "768:cu/Zo4AqUq6CYXAA9ia8CKBqAa5z8ESENCoHRDoVMOTRniCswQ1:h/ntUJCYB9ia8766DEYsOVHniCsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629142127, "uuid": "6a178e28-690a-4caf-8a38-c26fd712b75a", "value": 51124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629142127, "uuid": "cd983855-488d-4a96-a047-63dbcc908106", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142127, "uuid": "709f92ee-cb1a-4719-8a14-068493af57e8", "value": "d748bbcc62cb2e0fa4a14d95ff8bf174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946f9902-fe8a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629115671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115671, "uuid": "c2c377be-508a-48cb-9a47-fe5aa9e4d7fa", "comment": "Malware payload (Formbook)", "value": "6890bd33b210a9f974a5e9a0d5d139f0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115671, "uuid": "541378d0-78e5-4a64-865a-de29c226793d", "comment": "Malware payload (Formbook)", "value": "33c0a2192636751464430e0fd3155030f6f9dc3581b6271677c686e4c2176a02", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115671, "uuid": "87106ee4-7ca1-4650-ad51-3f7562acb3da", "comment": "Malware payload (Formbook)", "value": "00732d0be1b50ffff2c6f50030d8ab3162397c20", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115671, "uuid": "5544f7c7-7b93-4802-85b0-a61410a12e02", "comment": "Malware payload (Formbook)", "value": "93a0111efde8ee1281ced0179a66008bf6e0a410dd087ebe5fd367495990a339e564d8ccfd0a292152acb6e7e11c90d2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115671, "uuid": "be3c7825-6dd7-4dbf-9d1e-e6d93282abb2", "value": "T1E24351ACD56742A48F85A7B86B2B6F84018C7B2DF78495737278AB7413D2D3A801387D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115671, "uuid": "ceb96882-7e6f-4e97-84b8-4fc2dc3e71ad", "value": "384:AakJw3vEcDKnZVTZJNW07pys29jxm6JSKFaU:AaSwDmfTZKgYs3cF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629115671, "uuid": "ec29fbcc-7634-480a-bf90-d6f9811403b4", "value": 59865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629115671, "uuid": "f0259aa9-dff9-430e-94ce-9ce55ddfe1dd", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115671, "uuid": "8ca3f6f3-54d9-4846-a6ad-ec77d9c6d463", "value": "RFQ - 14000102697.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7d130d-fe72-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629105137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105137, "uuid": "28ff0bb1-6021-4787-a7ca-1e11cb377457", "comment": "Malware payload (Smoke Loader)", "value": "ce331ac10ff07a04236e82766267e1c1", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105137, "uuid": "23693061-51f8-495d-b83c-c811a92dd9aa", "comment": "Malware payload (Smoke Loader)", "value": "33c9743aff75b1eebaef927059a4373de1ed4f8e984735c775cac98c18bdec90", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105137, "uuid": "890fc4c3-0da9-4a87-8863-8389bc111f93", "comment": "Malware payload (Smoke Loader)", "value": "9e56b774e4be6f323748a4c2959eaab9992f922d", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105137, "uuid": "291e8e4c-efea-4909-9e6f-0e8e980b2045", "comment": "Malware payload (Smoke Loader)", "value": "c967961ff451895bb497a1e79be74fa634f9b7e02a35694b196691eb790d0e0a81abee26b94f5f0181ad347db447380e", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105137, "uuid": "66f4a23d-3551-40e4-a00f-95c850eef984", "value": "T11704CF1CB9B0C572C5910D3844A1CEB4DA79FD3296D00D47AB982A9F6F303E176BB35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105137, "uuid": "3975318f-444b-4e53-bcae-b759891b3d09", "value": "bb83c011665369ed6b0cea575e6793b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105137, "uuid": "1f7cb630-222b-44de-884a-994676b62006", "value": "3072:TxLih6DcIGYaK0CPV+gMYXBNzPRSoWJfPBWhkfNGSfPH+:VL49APVsc+oWdPB8VSHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629105137, "uuid": "dbc0df24-5611-429a-bb92-560e13c32597", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629105137, "uuid": "4ce24055-5415-43e6-9612-ff5559d8bdff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105137, "uuid": "11b6050c-f1c4-45b0-8c7f-1095d8588569", "value": "ce331ac10ff07a04236e82766267e1c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6002b9f7-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629134051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134051, "uuid": "8c761a1e-a622-4f28-8649-a1d90c1ac083", "comment": "Malware payload (Smoke Loader)", "value": "6597148ba8b6a0d6f2232d11aa291100", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134051, "uuid": "6456c446-2a1e-480b-890d-3d59bc189236", "comment": "Malware payload (Smoke Loader)", "value": "341affdc32c116eeac3bc8af74eeec475feb728b9bc8a56a4b35ad4755707d5e", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134051, "uuid": "61abc262-c611-47b8-b96e-6259479318f0", "comment": "Malware payload (Smoke Loader)", "value": "7a5d27cfae50ba988a4f624409343cef0f4420a3", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134051, "uuid": "8d4cb9c9-6cbc-4541-98af-c66baba0214c", "comment": "Malware payload (Smoke Loader)", "value": "4be9d71dca4873c50f596bdce686119c27ed92de5a5901ba6a838cd0475680099e98aaee09fcd65875bf30402c752ed3", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134051, "uuid": "fb66f56f-9bfe-45d5-8ec8-350cac9edf19", "value": "T1E514CF1D35A0E573C462037080A2FAE05A69FE71EA91465777983F9F2F307A0963739E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134051, "uuid": "ecb0e01c-5cf5-4b9c-8c51-54bdb5bc38ff", "value": "32eca4427f106c548c06ec4f87d7efd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134051, "uuid": "f80ac3ce-bc1a-4a3d-b871-3c3df17cc0bb", "value": "3072:CnO59tSY9BdjC7KvYl0OotEBN8LRvQuKT0yB3nqdri0oCsk:ChOi0OoOXlPqdFBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134051, "uuid": "b4d8d71a-0450-4e37-817f-868a402b10ef", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134051, "uuid": "737e65d1-2d3f-4470-bce5-87c1422efcf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134051, "uuid": "ea80b337-e232-4ac8-827f-2dae71797ccf", "value": "6597148ba8b6a0d6f2232d11aa291100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4421b4e-fe3e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629083136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629083136, "uuid": "467b7491-0861-41f8-89f2-48cd463b9fda", "comment": "Malware payload", "value": "320501d2b60b1f160acbef3919c688fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629083136, "uuid": "11c92ed8-7673-41d4-b350-d5a1f848f89c", "comment": "Malware payload", "value": "3474885d8a6ef157d6e9893df6c81bcb8273a1f438d641b4a9324ab3823b6539", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629083136, "uuid": "ebda0aca-6c45-4120-ac2c-49ee9fdbb282", "comment": "Malware payload", "value": "35c8ac1245b09ca0144484f5993926b96512c87e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629083136, "uuid": "8d834460-8cd9-4a96-961b-f3b552483b27", "comment": "Malware payload", "value": "b10dd008803140b4959a621e18f031455c303d1cee063fed4b12e79fc084ad797bb37afb3a07978b6b8c27ef953d2786", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629083136, "uuid": "0af4d73a-cadb-4509-ace4-4bfe758d6687", "value": "T12054F10DB99FE972C38635740473C7AC56B99F20D56309F72B452A6E6E30EF0932634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629083136, "uuid": "19545023-7196-4eac-ba63-f4e82bccbbaf", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629083136, "uuid": "a5c548e9-a812-4710-b341-0057359eae42", "value": "6144:ZSLNgQouQ/TluLtnA0wdE07bjq63c/mp3k:ZSBbdQLUwVfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629083136, "uuid": "6cae5173-8877-4496-afec-3bce2d611ea7", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629083136, "uuid": "ef6cdba5-5c86-417a-bcfc-d8aa31979680", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629083136, "uuid": "d74e6294-f38e-45bb-b4b9-6f8097c1b730", "value": "320501d2b60b1f160acbef3919c688fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a6820e-fed3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629146785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146785, "uuid": "a63f9b22-ea1f-46ba-b877-87239d21bdb0", "comment": "Malware payload (Dridex)", "value": "c576254df1035c7729cf259c72dcf023", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146785, "uuid": "02bb5bae-b789-46d4-ad4a-3e43f438127f", "comment": "Malware payload (Dridex)", "value": "34b37c76248658d208da1630b2d9ce36147ad34c7caa1ccd2d2abd00191beaa8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146785, "uuid": "ce11ab9e-fbb7-4ce8-9f3a-f5097d6a572e", "comment": "Malware payload (Dridex)", "value": "91d21c84e0df76772cf060c3d099a122cef4116e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146785, "uuid": "8834f01c-7b92-4903-bf33-0b53d6d2c6b0", "comment": "Malware payload (Dridex)", "value": "b07bf2dcb36c9af597d1335952b3c6cc512bfd78c4ec9ea92eaf7e2a673787e220450aca35e5e6212058e55c50b98e67", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146785, "uuid": "bc5eee79-c682-40ee-92fe-4d93c7b7bbc0", "value": "T12A4401456957D59CFD4F7D3C5CCE11B06F8ECE6D0000AC6F36E1E52CEAE42922C6698A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146785, "uuid": "eadac65c-c64d-4640-a231-44703d79fb1a", "value": "6144:S3tZbAPPimNA/kjoitksySYITIRLQjT7mpOj4C88wXO29oF:StZbAPDNAcM8yNbLQX7m087FmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629146785, "uuid": "f4de0ff6-5891-4def-adbd-8af84f6c2445", "value": 276146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629146785, "uuid": "47d5c45a-2283-4b5b-923b-12ed95b01037", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146785, "uuid": "2d0779a1-b034-4b62-8ee4-8fe7e5dfcf0c", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_1_388117.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f09bce0-fed6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629148250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148250, "uuid": "49d359eb-a679-42a8-9179-177d75023831", "comment": "Malware payload (Dridex)", "value": "53e85f8436d183a75e72414f88928550", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148250, "uuid": "2b4a20f4-d640-4ef6-865e-bf07db4a2ea2", "comment": "Malware payload (Dridex)", "value": "34fc29dcd890fbb5923ce64a4d9b693e9a35da591af42df261473ba785694537", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148250, "uuid": "38c4d2f9-7e89-4213-88f3-12121a7f9800", "comment": "Malware payload (Dridex)", "value": "27c0a5f4b650b886afdbae9243e89087d021256f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148250, "uuid": "f3cd28f5-2aa6-4bae-8c06-35a6b73d21df", "comment": "Malware payload (Dridex)", "value": "a276913df35d9298a0b2aea8d69554b7c7abd5a687903dcd71dc2886eb77b2cf347ae7dece770a68f7a7d1035b369dc2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148250, "uuid": "68415fbe-fb0c-4e8d-9fd5-6ecf36e930b3", "value": "T1C134021545B3E164EA97903D8C9B1FFB2376CDAB58C06B27F9D4A00D5D09DE232E224A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148250, "uuid": "129bf9de-acf1-4127-a960-79628ef6a7a4", "value": "3072:SfAeN0RKSwCchO7e/1GrpdXx6sj848ToZYd18URrI4+g1Cp1X/DAkGjGfl/FcKMJ:SPNSLcq+YXEsfURr5+5hhftFelrEINt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629148250, "uuid": "872ddfa2-1fbc-41ae-ace7-ee7bbab27411", "value": 249014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629148250, "uuid": "c9cfd9fb-dd18-4177-9843-3fd36a1242e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148250, "uuid": "b0f68424-5fd5-428c-a3b9-a93fe480cee2", "value": "taxve_97350_20210816_5367157918_1729537020.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9976f768-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629104942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104942, "uuid": "f94a3041-53bc-4c9a-bed4-8bba7b794f34", "comment": "Malware payload (TrickBot)", "value": "695dd2806fe91549315e79cf4dd3201e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104942, "uuid": "0bd44903-37cb-4ed3-ae86-e7f2b863cf6d", "comment": "Malware payload (TrickBot)", "value": "3533489809de87c678e6f04202f369e771de084c3e41d363a6879cc46f2423a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104942, "uuid": "cc999fc0-2ae4-43d3-b362-ec81a8f03e50", "comment": "Malware payload (TrickBot)", "value": "112edf045492e4e9ce5480f8f88b5348920c5d7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104942, "uuid": "2f3b89f6-f503-441d-9897-1a8fdbed8655", "comment": "Malware payload (TrickBot)", "value": "442fe97fabc1642a1fee7415e050c44f2ea01f20af018ace5096361394486cdc69e85dde90976dfe0e319ce749cd92a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104942, "uuid": "ec19aa80-a7f5-4a48-839f-307ff4812ce1", "value": "T13AF49D0135B1AC76D5A111B30EE5A66D5AB4AFC8772149CB67D0BE0C6B72FC0CB36236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104942, "uuid": "e6ac313f-2697-4801-9e11-2516cb77a1ed", "value": "878b3c97f2cf4cbb19fae7bf08b6bf6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104942, "uuid": "e3b23d96-74db-4c2e-8a84-be1d698dceb5", "value": "12288:3zgiXyC0EB3NGJwP888888888888888888888H0u7Kd6jIq+5ZWZXdSisd:UiXyC0m3KU888888888888888888888u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104942, "uuid": "3717c1f4-ab47-4538-9c2f-84c9d61d1ee0", "value": 778289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104942, "uuid": "17726d8b-e912-44f2-b0fb-1180619f76d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104942, "uuid": "27797da2-d5d6-464a-b1fd-3d1bc5218fab", "value": "695dd2806fe91549315e79cf4dd3201e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af567748-fe90-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629118293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629118293, "uuid": "e93d74c0-8003-48b1-8ad7-ef6071f38aa8", "comment": "Malware payload (Formbook)", "value": "1423f1e7d436fa26d50fd804f5b93431", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629118293, "uuid": "26f8d4c8-9c8d-4849-90ec-f4cdab811418", "comment": "Malware payload (Formbook)", "value": "35a776da3e6d2d8bcd69a7427ab25846c233403372bf3ecb6055c252ae696766", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629118293, "uuid": "ca24567b-2b2b-4ecd-862c-7e0be69faa00", "comment": "Malware payload (Formbook)", "value": "8f8cf7968a40dc8aa8bc7976942263d96acab605", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629118293, "uuid": "9ae742e3-5e89-4a8b-85d2-5ded50362f0e", "comment": "Malware payload (Formbook)", "value": "fe5eaa470c1a4fd6f18c82ea73ad085f784d1c8c21eb73beca94653776fadad5645d3edf1c5a84cd31281c4131a085ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629118293, "uuid": "e74abfa6-3f3e-420a-824a-4a2c55c6c2a7", "value": "T12A05CF7171E78A96F51F4A742578BC5003B231B3A9C6C9391B5A614ACFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629118293, "uuid": "24fd6cf1-a4d4-4ccc-96db-6b8bd1720819", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629118293, "uuid": "c6c833f1-0d29-4b09-b2fb-3cfbc3ac9612", "value": "12288:TN+tMhM84jPgqW7nqab4cMa+J4jMqoiDgo7VADzTJXGwq5JOEPpBja:xzhM3jz1OJ6SeiD9R+XGXHPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629118293, "uuid": "bebcd476-a1a1-4de8-bb17-0449c0f6a3b5", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629118293, "uuid": "0fe1d15d-e974-4da4-b2db-0ae1a8f1f9eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629118293, "uuid": "64ab8d8f-5f0c-4d53-a1cf-bb0ac64c8f53", "value": "1423f1e7d436fa26d50fd804f5b93431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8803109c-fed2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629146574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146574, "uuid": "a6b7d226-d549-4770-a381-fa4f9c1c4457", "comment": "Malware payload (Dridex)", "value": "675bf42fdf127ac4af393077b547ef3e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146574, "uuid": "a9bf2c70-5898-4c69-855c-15ded932721e", "comment": "Malware payload (Dridex)", "value": "380f93d6ad404973c82be90c927c4ee5d0075d03bb9bf7821253a16cbb532547", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146574, "uuid": "3c2b05b9-7829-4733-8fce-a1607a5d6397", "comment": "Malware payload (Dridex)", "value": "b85e8788d529c9a63d4ae261cb53f3a6c5e4a08a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146574, "uuid": "b0844fec-ca29-431b-870c-0935b93d5176", "comment": "Malware payload (Dridex)", "value": "bc2a657b66d5c68ed35d31ea1d69600ea875496cebf5a0b0cabd10993bd0e913d8d0cf5497faf08681c93dd19c9fa420", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146574, "uuid": "5257e32a-8308-4947-85ff-b05cfd737ae1", "value": "T1E164124A6763F11DEE8FAD794CDF28B56FCCCCB80D806A6F11E1A258D9D12E12D5108B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146574, "uuid": "894b473b-7cdd-4e27-9b49-31c3ffc70e66", "value": "6144:SUtZbAPPimNA/kjoitkIWEMM0hqMMq73OI6ttV+R0:JtZbAPDNAcM4H0hqMOhtTs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629146574, "uuid": "a8b427f9-145f-4670-abee-be9eb76dd30a", "value": 325857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629146574, "uuid": "22df95c4-d2a4-4a09-89c2-584bb6a27e1f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146574, "uuid": "7d7e74f6-fd91-45ff-be77-5de9afc1ac7e", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_8_82170417.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75846d1b-fedd-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629151267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151267, "uuid": "61fd4b91-fefb-4174-8a3a-1262f1fe4fc4", "comment": "Malware payload", "value": "68ec9baed33ba11a575f955963e9e7fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151267, "uuid": "59739419-1504-4ab0-be8c-d87418a369ca", "comment": "Malware payload", "value": "38da1c4dabd3275256a93bc7321267979802c35ec2cbd1ecef7a5ad18a61afad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151267, "uuid": "9883e671-bb21-4294-ab11-aed4d941c98a", "comment": "Malware payload", "value": "bfd55c4fc230dcee8d5191adb30aef019f13902e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151267, "uuid": "78e05ff1-1126-4dc7-a958-3b1a3e6b57b9", "comment": "Malware payload", "value": "6fee6626baf7f33bf8a74ff036e897e24205eeb8ba21a254086e74db0f335e856da5f75bd2aa792c918a32e26b6e6115", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151267, "uuid": "96b207a7-1cfb-4a89-a0a7-890da2a940d8", "value": "T17C558E33F2935437C13E2A39BC36625558297E102924788A3BE52FF85FFA6813B251D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151267, "uuid": "6c9a34a8-c12f-49d5-8e76-3e5d37eb89eb", "value": "0502db06ce2121af54f791df4affcc47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151267, "uuid": "3926c2b6-8b6c-471e-82e0-02e46b9f1785", "value": "24576:oPW9bd22szK2K7DawFENSgbytkj3VzlAYSnHOslvX3:oAx2BNNbytkj7WJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629151267, "uuid": "31b136b3-e214-49b8-b0c9-6069cee16516", "value": 1371136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629151267, "uuid": "cc94d534-ebd6-4bf3-bfa8-8f44554bb26b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151267, "uuid": "c2e9bf42-06e4-4f6b-93a2-cd214f94c9aa", "value": "68ec9baed33ba11a575f955963e9e7fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e7cb04-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629104852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104852, "uuid": "b946c9b0-da9d-465f-a375-4e756d7a42b0", "comment": "Malware payload (Smoke Loader)", "value": "5b17d689015c096af1a7fcb4973807cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104852, "uuid": "5937acc4-7058-4ecd-b612-43cc7bf8278b", "comment": "Malware payload (Smoke Loader)", "value": "39894026621d1c5fabeca0fe3b0ba3fe2e97d99e17d50227ead4ac7c64ee080c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104852, "uuid": "fa4e76ef-d374-42fb-bcd0-b6ddacb02868", "comment": "Malware payload (Smoke Loader)", "value": "41e3ec5c934dc452cc28ad030229824a4cbb1d9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104852, "uuid": "d09c9432-a5ba-442c-9bcf-9e8e353b2864", "comment": "Malware payload (Smoke Loader)", "value": "ae02a747f5e6c0e154bcad27dbfcae98b3f8c38d5000049f00484e469c367f20ac7f7f81aa0bd823c87ee4d0a3f68d14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104852, "uuid": "3776ff57-4b84-49dc-ba7f-6d238218bdde", "value": "T10004CF1FB68FC473C741703144B3CBBC1A789B28D653097B2B982A6E5F70EB15666349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104852, "uuid": "c74adc55-9096-4381-a377-bd4c54e4966c", "value": "b6eb307a53194f1a2629d22afffc5564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104852, "uuid": "2f7a1126-64ea-46ec-9dc7-47363165d139", "value": "3072:RLEh+DjIWOM+hY+LQVMLBNDaR8c/mbVloZ7yz:RLhp+hY8GM17c/mbnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104852, "uuid": "5ddce467-be81-4266-8b9a-80cee0a836aa", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104852, "uuid": "354c7a89-8287-44b6-849d-d34d441daa0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104852, "uuid": "7e3736d3-4170-4f32-88f1-b510fe10073e", "value": "5b17d689015c096af1a7fcb4973807cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b573a0b-feb2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629132782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132782, "uuid": "48208e6a-bb49-4395-981e-8eabe19d09be", "comment": "Malware payload (Dridex)", "value": "14f2664efd80eac5191054e3130a1bb5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132782, "uuid": "603fac0e-e7ce-491f-b375-c7d2849c331b", "comment": "Malware payload (Dridex)", "value": "39cf6e1fde46db830d2deb798bac464e106b02779b7ef3861620910b8c7f7983", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132782, "uuid": "80fea9e5-b661-47ad-8712-bb2379c5ce24", "comment": "Malware payload (Dridex)", "value": "d9f3107f817ca6aa8ea0e7581ec655316d235c73", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132782, "uuid": "238821f8-fb6d-4e7d-9f8f-d47509c715b4", "comment": "Malware payload (Dridex)", "value": "ef1f2de4428f36ee1a2184be6426e79a87ebb69daa926c4450548a932aa454ff0557e9b0e22b62b3b63b20b6530891e5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132782, "uuid": "8ddd17f3-7ee1-4f96-bd3f-f0dedc41ced9", "value": "T1B954F14559A7E91CFE5FBD7C8CEF24B07B89CDBE1900296F21E1E60CD8E42E51C5848A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132782, "uuid": "5ca48eb2-f10c-4061-a482-62b7ad289910", "value": "6144:SvtZbAPPimNA/kjoitkg7dZB1Ka6/vC6gJTTqok4R783Hukay:GtZbAPDNAcM6dlKa6WfqKRQtay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132782, "uuid": "089bb472-6211-421d-b461-c6200847efbd", "value": 304201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132782, "uuid": "75c034ec-edb8-49b2-9452-e4c9632b36c7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132782, "uuid": "5875f794-859b-4c15-924e-4e2647df97da", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_6_97595822.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632ddd40-feba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629136204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136204, "uuid": "b8f6fe88-a3d0-4e61-a5a3-6fb0dcd21954", "comment": "Malware payload (Mirai)", "value": "add39ac9e776405e9800fc1db1816f2c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136204, "uuid": "2108ad0d-2e95-4e80-b7b7-d2a13e93cbf3", "comment": "Malware payload (Mirai)", "value": "39e148901bc07e996edcb6838202452d160f68c1638fb97c9fc319d3a8115edb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136204, "uuid": "9961770e-4ced-4f0c-b3f5-20a439b2d4bc", "comment": "Malware payload (Mirai)", "value": "f50c2486ce431dd567cea23aa49f1672e2833b0e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136204, "uuid": "f6ec4ce2-49c3-4808-b105-8c7cdc9f1417", "comment": "Malware payload (Mirai)", "value": "a1b6475986ba56c1bca3b734627876e5ba797eda42cd939205c99b078607f828bde47e8c482211e259c042f7f4e16832", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136204, "uuid": "ca0ce892-4c50-4a51-bacb-4290c22fa92c", "value": "T1A803F15340452776FAD58B3AF37C82837BEF01A89D2433A45B3F4A5CA759216F6B500E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136204, "uuid": "13ed3ecc-9d99-454f-81c7-a7410118bd7d", "value": "768:e5UShvxa5BDsJIVddrXQrT7RzEZq3UISxFFWXcKWgvLZn//zibpHpgJD:e+SNxavDsJI1XYdE2kIXcmv9//z4HuJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629136204, "uuid": "e41eefd9-343e-4741-9a80-230f02f46488", "value": 40668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629136204, "uuid": "e7637deb-c920-4812-8141-1b570c8a7b77", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136204, "uuid": "ceefbb1b-a55e-428a-b5ba-21f40d559e9d", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91fde69-fe5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629096888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096888, "uuid": "601369dd-afcb-4fb1-88ac-f53df49371c3", "comment": "Malware payload", "value": "162066f07521320445f3778a03b4f606", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096888, "uuid": "f449fe78-2ea4-4325-8d77-0f0f28176f38", "comment": "Malware payload", "value": "3a27511a3dc6e7980eb185cb28347c8f731a4e36f29fdca43fcb8b71aa49520a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096888, "uuid": "ebb8066a-1489-4661-8260-d0d9437dc49f", "comment": "Malware payload", "value": "8b9474247a1917f975213fc9a8586b74e8748fbd", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096888, "uuid": "3697d112-5b2d-4bf7-a3eb-8d6019836f3f", "comment": "Malware payload", "value": "a16c43e0570feb6f69ccbbfb6e9abb501eb978556c04fd3992a1e9d6551c36d571d7baa98d41056899779b92ce0cf14a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096888, "uuid": "2ca8a968-b2fe-4527-92e7-331c1561062c", "value": "T194537723676B74041A2E3B80EC796ACB0A4AD7609516012F3B4F8E7FC26FDC54553BA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096888, "uuid": "946efffd-3306-414c-a900-00eb646cae80", "value": "768:an8RLwy499w1CxmxqGjKlkYhQy68f2Sg5H/6nGloT5B6d4FzB/HxRJEnARJ2S8I6:jV6nGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629096888, "uuid": "93a98bfb-9d21-4e50-8661-f7c37bd583cf", "value": 60948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629096888, "uuid": "fcbf2be9-f76c-4265-8b84-a42040e339cb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096888, "uuid": "bdce88ff-8809-4cdb-a8be-45b2fb893160", "value": "Copy-M87654.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc34f0b-fe8b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629115871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115871, "uuid": "fc5c89ce-abdb-4761-a6a6-afafe08f15ca", "comment": "Malware payload (Formbook)", "value": "2875b6d653a9311f91e1a2f28e5538e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115871, "uuid": "684f3f92-eb74-4c9c-887c-1a5abfc54665", "comment": "Malware payload (Formbook)", "value": "3a30a00f6eab6a14476db7139c5512302b5fff48a3111ccb6ae8e0964213f8ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115871, "uuid": "17b3f0cc-d506-44b9-9cea-ce1f1a843c17", "comment": "Malware payload (Formbook)", "value": "6f13158f25a54b1631ce935f90db7e3daaf4257f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115871, "uuid": "560fd5b3-1267-4776-941e-2764e5bbef37", "comment": "Malware payload (Formbook)", "value": "252518cb49b638e494c3233da1f0ee74d0af71326bc73fa84b062d68ef9fcb195c7f924bc06758cfff3aebdb04739473", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115871, "uuid": "22039fa3-95a1-40e6-8357-08af6f342f84", "value": "T14845E73915B82B27E079E369E6E44417B3E4A45FB225ED58BCDA03E70206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115871, "uuid": "12299ffe-f5ef-45c9-b7ce-6869acc2064d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115871, "uuid": "55d1c30b-45ee-4779-a9e2-d1de136d6e63", "value": "24576:PSWnZPFYyblhB2PLKuUSxztfzvYIDWrWdT:ryK12D7DxpfzgHrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629115871, "uuid": "5c575dfd-761b-439e-b49c-b01f2d76ed02", "value": 1208832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629115871, "uuid": "95e853ee-d014-4461-bfa1-f7fc7b86ce16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115871, "uuid": "e2f71078-1ebe-401a-8d9e-e2347bd4cc72", "value": "2875b6d653a9311f91e1a2f28e5538e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0ff038-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629133989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133989, "uuid": "aa6806cd-ee0f-433d-84b5-432ec294c292", "comment": "Malware payload", "value": "c93f3846395cc04d9c2b2f0bca6c9d2e", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133989, "uuid": "e0415ed3-2555-48fa-ad3f-2bacaf9a1bcd", "comment": "Malware payload", "value": "3a6153f1b3febe98a8ac7bd0704ae363b53e1efcbebf6f25d5b780fc011c84cc", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133989, "uuid": "46ff44c3-3623-4018-a814-c995eaf94966", "comment": "Malware payload", "value": "d13649e05e61acd56c742398f70ead1ab260d056", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133989, "uuid": "486f8b17-d3c5-46f2-a33c-1f0242df9190", "comment": "Malware payload", "value": "40526d61d38d3bb0000e6712edd6697b5c6537f42fe00c04365c7cd7eb9dc37e620d58dd061f73a93675a9024fa2d5ac", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133989, "uuid": "07231311-f623-4c60-bb20-7b96fb6082dc", "value": "T14022905B6C90D499CED1997CE279257EBA27FD2A708D520B8004DF498E24AB3179A10A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133989, "uuid": "bfec8d3a-be40-424a-a1e2-59db3643aa55", "value": "192:xrXP/x7bYfz9PDBVkaWhxaa0UyynO1T8U8g4occdoBiVSVmXFeju:dXPtbOzXVk7jaqnkThN4oc5Bi5k6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133989, "uuid": "3c64461d-22e1-4f2e-8cc4-f6a9bb7c8c74", "value": 10617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133989, "uuid": "aa2f0e2a-d68a-46eb-9627-3f017af512cf", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133989, "uuid": "e75f2163-6748-44bf-906d-83d376b305d9", "value": "Checkpoint PO#948400.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6653ba63-fed8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629149094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149094, "uuid": "fdcf7148-4312-46b2-9c68-bf8f04099655", "comment": "Malware payload (Dridex)", "value": "120dc19fa296ef630b6d8a91abed7d2d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149094, "uuid": "6d33530a-a349-435f-9a20-c5abb4bbd886", "comment": "Malware payload (Dridex)", "value": "3aeb9cf319425bd4df2d579f28aa1fd61aee9fa37b2c02b035f05c19b823a584", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149094, "uuid": "ac5719f2-d45b-423c-a009-2ddcc4a54e2b", "comment": "Malware payload (Dridex)", "value": "1fb90e4d2977383a2283c108b51991abeae833e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149094, "uuid": "7a9501ee-1fa6-4628-9854-a49e00aa6d34", "comment": "Malware payload (Dridex)", "value": "cac7d61798cb2e0d466cf4934aebfce6bc2a390ebb9c136ff2fddb773978a1cc4a7167ca741e27dace07d49bc6498319", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149094, "uuid": "2d7a996a-5060-44d9-ae0c-4a1bf8e7bf56", "value": "T1B844021A42B3F5E4E59770348C871FF907B29DBB00A06A06F5E1B64EFD1EDE35162489", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149094, "uuid": "65b2dcd5-23a5-4cbd-b6cf-5d8c29f3f6f7", "value": "6144:SQNSLcq+YXEsCVoizJJwyZfyMO1jWPVRHxYsQqzg:3PYXEsu/Pn1+WPVB68s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629149094, "uuid": "89c0f733-2ce5-47f6-bfa8-5fabd652eca4", "value": 254713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629149094, "uuid": "27e50e73-1a5a-4cb6-bb5d-71869ecb6c10", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149094, "uuid": "3bfa4282-eb5c-4b3f-be45-a46a2588f99b", "value": "taxve_0309490152_20210816_095418297_32601709.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ede41c-fea9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629129048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129048, "uuid": "6b469c19-1f62-45be-8cf4-0512c2a18ea0", "comment": "Malware payload (Mirai)", "value": "637722e57abcb01f8b298bcaec91b5a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129048, "uuid": "7119516c-732b-4f9a-8e10-bb784f6ce3ab", "comment": "Malware payload (Mirai)", "value": "3afee37f3a27489e8b29d199a29758b9a15035ce120d13a2f8ae4f699b5579e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129048, "uuid": "ce232a71-795d-4c5c-97e0-1b5dc38c4880", "comment": "Malware payload (Mirai)", "value": "2107a815bb679efdb2f1202f4ab278e648a34a82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129048, "uuid": "0341bdb2-d9f4-4b7d-bdc4-a9edc10066ec", "comment": "Malware payload (Mirai)", "value": "3cab52f463b2bbea1591e91559b1cdf08f7da55e49789749a222627cd53531833a8aa2de656d1d5b78b21d47c9fdb1e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129048, "uuid": "18a5330c-71ec-47bb-83cc-e1234ad75619", "value": "T154235D42B31C0A4BD0635EB4353F17E093BFED9011E4B5C8691E9B8A8535E371186F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129048, "uuid": "11711c0a-b788-4cca-8fef-b5ebd223121c", "value": "768:AEgZ5XpRPW4BGik/MY+PUkJUcP1o7kBy+6O0PKXSb4kzb:Q55jGimMYetJU+Hy+6GXSbxzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629129048, "uuid": "d01ff2fc-ec48-4ce9-bfb8-cdda924042fe", "value": 46876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629129048, "uuid": "cec11349-fcdb-4da7-8fc1-e418a0ab5e40", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129048, "uuid": "435abea7-84fd-4b97-8480-5bfb23eb218f", "value": "637722e57abcb01f8b298bcaec91b5a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e7fff1-fe6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629103438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103438, "uuid": "a0048a25-5de1-4025-9b88-64bec0690c21", "comment": "Malware payload (Formbook)", "value": "cb71c64cc05527c5d4680d005574e77c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103438, "uuid": "637708d0-77c4-4e0b-984e-9fa3fbc75605", "comment": "Malware payload (Formbook)", "value": "3b2b948053944b0eadbfafa1dc127287daa7f76602afc2f8746ead9a483e4302", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103438, "uuid": "3a8da736-b0c0-49c1-9210-c19dd9e1130e", "comment": "Malware payload (Formbook)", "value": "e6aa264d0964c0c0b39a89c48588ba0abe54058b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103438, "uuid": "0f3e4f24-0228-4d53-9c61-1d8f476b05a4", "comment": "Malware payload (Formbook)", "value": "e11773f6cd457f92e7c52ede60e5be49bbe50620d7f4864f6a914d3b4c7af3b437f7b767b766b4f385e055853350a5fb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103438, "uuid": "002f2142-9c1f-4aba-881f-a5bf9ef84c0f", "value": "T1DE4512D07299B7EBDFB733B0CD1348D71058CF287AAC6925E609352614383E3979A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103438, "uuid": "6df9b9eb-ba1e-405e-b567-9734f77adbc9", "value": "24576:Z412o6ZoBhJqpsXMUpUk+S0vYijwYEe8E4rnDIPgLz14TYLk:ZXobP1oSPLe83SYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629103438, "uuid": "cfc96ad5-2402-4967-9c91-7fd241e7b053", "value": 1213080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629103438, "uuid": "1b311b92-7cef-4df8-8f2a-f1cbc27e5380", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103438, "uuid": "4009a56d-0152-4ae7-86a3-263a30b6b10b", "value": "Shelter Tent Manufacturing New Catalogs.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bc8c2f-fe86-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629114012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114012, "uuid": "acb9c296-f0de-4429-a704-98f5c75fa9fb", "comment": "Malware payload (Smoke Loader)", "value": "de4483cc64d0e5b375c9eab952865dec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114012, "uuid": "de0ab948-bc0d-4a41-9d76-e7bcd9b974ec", "comment": "Malware payload (Smoke Loader)", "value": "3b3a5a4dcb2a74053b9ef1514557ea3e19c14f818ff2dce8a06166b421b4c5a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114012, "uuid": "be70e863-ebaf-4658-85b0-efd5f3bb7bec", "comment": "Malware payload (Smoke Loader)", "value": "2602ff86546bd8ec9239da61519736b7541e2fc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114012, "uuid": "ebac3154-f471-45e4-9725-39f625c68153", "comment": "Malware payload (Smoke Loader)", "value": "cdad8b998f919675ab88b88210012c1dd54c8c71a2047957070fa714c5cae14a79fcd4e9e20e28951d29c9175c6da2d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114012, "uuid": "956238d5-522e-411a-8909-b4044493cc33", "value": "T18504BE2D799FC073C756393044B38BACAA74BB20DA53097B6698255F5F30FB0962634D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114012, "uuid": "6aca4be0-3d3a-4b13-b26b-066a607232b3", "value": "675f985c31bb43cb925f7664d8fe06b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114012, "uuid": "3feeca86-b24c-4190-95c3-ffd4f8fb510d", "value": "3072:iW0LJHWDX7njINfZ94ABNgSRENc/mdEZ7yq:YLirjINfZz+Nc/mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114012, "uuid": "a5cdf8f5-ceb1-43bf-9f14-7ab162062a7c", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114012, "uuid": "e5e05d45-b3fb-45d9-9ea8-44800dc9e214", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114012, "uuid": "5329b2b7-b523-4715-ac9e-90434a0addb7", "value": "de4483cc64d0e5b375c9eab952865dec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703d6e5d-fe86-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629113892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113892, "uuid": "996a9607-ba85-412d-a308-937183046191", "comment": "Malware payload (Smoke Loader)", "value": "8e0b34974c12c89336be8b32dac9def3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113892, "uuid": "c372e9e8-e2d9-4635-9a16-0b051ec3be1b", "comment": "Malware payload (Smoke Loader)", "value": "3c6212ddbefc0ac8d886d5c9efd10cee871af389d56ec4f96fd9ff08e8592379", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113892, "uuid": "4f906091-e048-4356-83d5-3705a95bd2d6", "comment": "Malware payload (Smoke Loader)", "value": "22277f6e42759f670ecc7a16bd442ed760b320fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113892, "uuid": "07e156f5-90e5-48a9-84ce-a1f28ba2db15", "comment": "Malware payload (Smoke Loader)", "value": "168e114ae99483314f5fe9035342bf6e977097e2fefa95fd3a1caeb8e51c60055a7ff7a0cf7a47ca55e7a8a42441891b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113892, "uuid": "2e4b8cce-ecbd-4ce2-a0f9-36cbe2801808", "value": "T18D04BF2DB99FD172C791353004B3CBAC1A79DB21DA17093B27982A6E5F30FB0966634D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113892, "uuid": "97518b6f-2cfb-4336-b765-fbc1051261f3", "value": "675f985c31bb43cb925f7664d8fe06b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113892, "uuid": "937fce1c-82ee-4cd6-b4a8-2c9cf8338c42", "value": "3072:HW0LJHWDX7nj0EeZqUsUKOBNgIRhc/muLTWZ7yq:HLirjCoUsPiBc/myZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629113892, "uuid": "88d7584f-96e9-4e63-9e58-7d149566f165", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629113892, "uuid": "0690c75d-05d8-4db9-a64a-29a815aaea55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113892, "uuid": "c3b1cd7e-ed5d-43c7-bf5b-25607061f67c", "value": "8e0b34974c12c89336be8b32dac9def3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5c03f0-feb4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629133592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133592, "uuid": "3269993c-901a-4a59-8007-87572b6d9254", "comment": "Malware payload (TrickBot)", "value": "0896adeee9ddd62a678707d7bf5980b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob122", "colour": "#D387A1", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133592, "uuid": "bc6b923d-a6dd-4e09-81e5-fa451ff8d693", "comment": "Malware payload (TrickBot)", "value": "3d3f9ef35b78b4368a3e098c6f119bf3bf103840959c71b52fcd979e78f21993", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob122", "colour": "#D387A1", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133592, "uuid": "681cff50-2f83-4fcb-848a-9c1ffae74f5f", "comment": "Malware payload (TrickBot)", "value": "88ebe16315b7ae546882fa6a27b5a95ad200e2c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob122", "colour": "#D387A1", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133592, "uuid": "a2a057f5-f988-42ac-9d82-6d4762995896", "comment": "Malware payload (TrickBot)", "value": "14f6b4a0343b16f8e2992e245fa645e588f5bd4134f279102aafeb87a5fc73f8bdb55604aaf7d7fe9ab348d515f0eac3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob122", "colour": "#D387A1", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133592, "uuid": "78948adf-8d8f-40e2-a5aa-462f4b27d9c1", "value": "T1761429D0A780D0035ACD1B53FF167EE9E13AE47265C4A147C6987B9C28B9857C2B8EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133592, "uuid": "6af68ffc-bb1f-4302-a9ca-f12a19751872", "value": "6144:Qz0R+XaKtjKSch+udORint3JNdG7Fnzdu3:Qz0RS/taD3fQJnpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133592, "uuid": "d6057841-cca8-475c-9834-ff9be0931280", "value": 204919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133592, "uuid": "166d037a-854b-4309-8cba-060c05dce443", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133592, "uuid": "4822e2c2-5ff9-409d-97a8-0c571e191045", "value": "794.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213f19f1-fee6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629154991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154991, "uuid": "c6af254b-c0bd-4b56-9d63-3502c1603972", "comment": "Malware payload (Dridex)", "value": "963a97b6efe44b61e3241b3747028987", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154991, "uuid": "16d7f7c4-4034-47d0-b777-8a6be343b29a", "comment": "Malware payload (Dridex)", "value": "3e5c3ca2dba4a97b5ce64954a2b4a01b29a140dacfc0401dcc75471545c1f49a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154991, "uuid": "027bb700-b814-424a-b5c4-b2370000fe5a", "comment": "Malware payload (Dridex)", "value": "65cc1ec0d4434bbe52d2c8e73943c3f845504f12", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154991, "uuid": "d33ce1e3-2dec-412f-a5d1-10f89dd073d9", "comment": "Malware payload (Dridex)", "value": "a0e1db107c5f5ae9e3ec60a4a51631c01015acc5d01ad841c8b34faa9e045cdcecea427ff21c9a3b84bdc9fd27c43a11", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154991, "uuid": "a4f998ca-14d5-4ac0-8d86-d8e03cf40d81", "value": "T1C634022684B7E160EECBA0394CAF0FE617E24F5B15C0AB1BE5D1A51EFD0ADD361504CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154991, "uuid": "9a0e1765-8e8e-4ec9-85eb-affdfb2ced2d", "value": "6144:StNSLcq+YXEstmCKKIfVeSrPwqWaswkoWMM:CPYXEszKTwaEoWMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629154991, "uuid": "d6e890e3-4ac8-40f8-a42a-5b0700c5013c", "value": 244012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629154991, "uuid": "ea535e3a-ab31-4bb3-b86e-e5ac58c502a2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154991, "uuid": "e0bb4cfa-83db-4da0-9d31-5a2d75c419b9", "value": "taxve_50694104_20210816_63660_25466460.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346f9777-fee2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629153306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153306, "uuid": "08e64df8-509b-487f-935b-2ace0f779ff9", "comment": "Malware payload (Dridex)", "value": "a55646de5abba69c44490fbb2cde44ae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153306, "uuid": "725ff139-0578-44e1-a579-4baf56a72758", "comment": "Malware payload (Dridex)", "value": "3ea6b6b3df93ce4d876edb88cf5c5e67a0fd7bae402f64bf643f98621cd0cc59", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153306, "uuid": "c8368d86-fb6c-49c8-8de5-ac3b794c4b01", "comment": "Malware payload (Dridex)", "value": "c0dda6dbaa6f3de0dc4a55769a0c4b7e6cd1d0f7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153306, "uuid": "43290229-b66c-4403-a680-57cc30851d38", "comment": "Malware payload (Dridex)", "value": "0b89b83214346c92507b1ecb4ec983693bb5443f59d3e7995113bbc4419af8e9473f00f0280c23279098eb5f11f7858c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153306, "uuid": "f9e911a9-7f89-4eac-afe0-e810a68fe87b", "value": "T1AE54015A6A97D96CFE9F7C388C9F04742FD9CCBD0100BA6F22A1F25CE5E12E65C14492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153306, "uuid": "e99a2c4e-8111-4677-9905-2bb9ca571f24", "value": "6144:SNtZbAPPimNA/kjoitkhqgKb09/QhukWRLOtUbOWUE0UG:mtZbAPDNAcMgDb0mvwboFUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629153306, "uuid": "dcbe25ce-cbc3-4623-87bb-3f06896e9992", "value": 296957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629153306, "uuid": "15948b0f-3bab-4d9d-9bc7-c5f5391c58ea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153306, "uuid": "7164922e-b8f8-40e2-8ba1-69caef293d68", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_5_78354.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f10536b-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629114212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114212, "uuid": "94f37d29-aa74-46eb-bb1b-2c744f73f22c", "comment": "Malware payload (DanaBot)", "value": "5f6df8db48f0651d13a8618db5cfda3e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114212, "uuid": "54f087e8-9d0a-41e2-9c20-79e5e43bc435", "comment": "Malware payload (DanaBot)", "value": "3ee5f1884ca0261665ff87cc41c7aa590aaac03b3f53dd8edfdaeefc42f869c1", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114212, "uuid": "6fff2145-01a9-44dc-9d5a-a2f203a1d9b8", "comment": "Malware payload (DanaBot)", "value": "6019289e5ce3649f754f6d6252e09a754911ba9e", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114212, "uuid": "35e75a88-ef3d-48bc-b731-4b9bf50ac24f", "comment": "Malware payload (DanaBot)", "value": "50405aafa5b04f6b7e8486126a68b6eb011b214e75a60a7cfef0750c887bd1d2b96828e472669ff0a8eaf53f27b59b59", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114212, "uuid": "a64a8c12-dcdd-4460-848b-00892a2ca7f0", "value": "T1D235232D784FC072D6023971603BC7BC055A6B71DA072AFB26DC443AAF31FB265A175A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114212, "uuid": "0db07991-1876-436f-96c4-7deaf759d1b4", "value": "675f985c31bb43cb925f7664d8fe06b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114212, "uuid": "c68567f7-f3e2-4652-b170-6d14d1398d38", "value": "12288:Kgh4+H97BRc8sFd8cboPc8+3EWS4LGW/BA9tHH4rlErvAs/RGN2ac9zHR/NTi5BZ:1BHjRcdunAHJ5stHogzzzHRFuDOVzJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114212, "uuid": "5ab0d5df-c5c2-4414-be24-22136823d256", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114212, "uuid": "fba59ab4-1c6c-494a-9e5e-a6a6848bc4f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114212, "uuid": "275e0325-c3b5-495e-a62c-4ef38eb73d60", "value": "5f6df8db48f0651d13a8618db5cfda3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74cd38b0-fe70-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629104451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104451, "uuid": "ea3437b5-136f-45b9-b707-b865a266c4e7", "comment": "Malware payload (Loki)", "value": "86a0a5565e4247965ccabef541358b43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104451, "uuid": "eeae7c8a-56f1-4ed7-b70c-4db0c1dc5f73", "comment": "Malware payload (Loki)", "value": "3fb730890c8c04eb09d8b2acff9c376d8054d5d3748898a907099055ec54f2ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104451, "uuid": "0cc3be7a-e2f6-4165-96e4-711eecdde1ab", "comment": "Malware payload (Loki)", "value": "4b103671af5650d2746d9335449dc4a9d80233e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104451, "uuid": "ba593315-91e1-4cf7-ab5d-23a46d4c7a4a", "comment": "Malware payload (Loki)", "value": "a56c353bdcc0dc81b95caa8cb7bfe79be5d871abdcd5003f2793da9f689fbcfaa4ebe7d1f67f49b3f853f14a0d93f061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104451, "uuid": "a48aff04-f44b-4b91-98c3-ed6ac5caba2e", "value": "T1FA94CF11B190C031D8A204789AF093B97D7D9E31172F64F7A3946A7DAE717E26E30B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104451, "uuid": "1b1566f2-ca26-4eb0-8e5c-7dceb4bbc000", "value": "53c59b75f4f7c3e4cf3b5a4fc5238353", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104451, "uuid": "067804c3-b0eb-4bb9-8864-47b69470ae9e", "value": "12288:q2B8KdNFoDaaWYBUq7hWqQYhNfTLDoQ6d:qm82FojWYq3qQs/bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104451, "uuid": "fc364d93-6fa2-443b-b149-0b3466ec1ab5", "value": 429546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104451, "uuid": "d43faa23-b79a-404d-b5e5-c18d2aa1211a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104451, "uuid": "4b6452f0-8126-40cc-9433-fe2bda1c315b", "value": "izzu file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444bb325-fec3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629140018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140018, "uuid": "73a32b0c-850a-4c58-a65e-d4c775d50313", "comment": "Malware payload (Dridex)", "value": "249eeeebfcbf07e72222561e88865393", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140018, "uuid": "52d499ad-9ba5-45ef-87a2-503ebd1b4911", "comment": "Malware payload (Dridex)", "value": "403bacc8471a626db1d20fbec0740c9d40bcfb7e51ce23cf1c1a287c7d6e4bb8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140018, "uuid": "86a59df0-32ab-45df-9550-881f16e8de2d", "comment": "Malware payload (Dridex)", "value": "ad94a3412798b1ea14d3f7f755aedbf58c112312", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140018, "uuid": "6b481ff5-941d-4640-ba70-049479c8fb11", "comment": "Malware payload (Dridex)", "value": "898314b45e63e36cba3f9c0e51e1293c3372edd5f9d16e525f6014a1b9d1e3c5ec01d49f696c02274646e985754a62f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140018, "uuid": "beae08f4-3fe5-42ff-88d3-71a55210f954", "value": "T15764021E8A77F0B8EC9EA0398CCB1FDD17B55D1B14816A17E5E2E10DED28EE3215118E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140018, "uuid": "102d5518-f997-42f5-b52a-bbf9d3d7b98e", "value": "6144:SeNSLcq+YXEsg0MyFBWOOJhH71R/GGzlBRE6+I/7x2wF0W:HPYXEsVfjSHFGGREU7x2jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629140018, "uuid": "36da0dfa-72df-470f-887f-54ba6e39b74a", "value": 320473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629140018, "uuid": "a9a1a09f-3522-48f9-9f85-f53f512ecc0f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140018, "uuid": "6e6587ce-83fb-4e63-b4ed-9f3ea6b53b1e", "value": "taxve_4672626688_20210816_40219755_8734925.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1cec46-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629104842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104842, "uuid": "12516ee0-0ca9-4d60-b09a-0cb3df55a61b", "comment": "Malware payload", "value": "96b3ab671e6abe11afe7c14a73a6f89b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104842, "uuid": "36f6105e-7200-4b7f-9f6f-476e81f15094", "comment": "Malware payload", "value": "40a71220b876aa90ac01ba9c62496a415f2e4a799e391fa9c0cfb11ea6edfea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104842, "uuid": "42aa64ca-7b2c-4223-9469-1dfd0a58cf47", "comment": "Malware payload", "value": "abc698bc7b4ae0c6c73e51e74863dccf245da363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104842, "uuid": "69fb9f70-8f9f-4909-a364-ae7d3b61af3e", "comment": "Malware payload", "value": "07fb7f7b04a15182d351c8092ec9be62a5c421a019ac2c5f318c4e364903f746731d6e978eddef6c1e16f9bf4cf25671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104842, "uuid": "d3b6b034-82a2-4988-833b-f28a8317fc37", "value": "T1B7547C5AB3A408F9E977823DCC525506E672BC170370D6AF07A0476B2F276E09D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104842, "uuid": "bf2a393e-945a-41ba-826c-e5d7a480427d", "value": "a53396e1aaf9fdd845e36b71511601bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104842, "uuid": "9019fd78-bbc8-4faa-b248-b15e022a35cb", "value": "3072:kQE0QsbzWEl1wmahWXIsHaCmu2T7cHPoMD+gyhR/BO5oY466HZpNMKW7ds:wy/LlnaIX3aCR2TAsgqCohZbPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104842, "uuid": "78892924-77c6-47f6-8dfb-70c8ac348a52", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104842, "uuid": "7ef75c82-6290-4559-a898-e6765fd3ea0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104842, "uuid": "0e93da46-6ea2-441a-80f3-9fa1625df0c8", "value": "40a71220b876aa90ac01ba9c62496a415f2e4a799e391fa9c0cfb11ea6edfea0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305f288e-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629125811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125811, "uuid": "cce2e9b0-ca77-495b-a654-3927ef97e505", "comment": "Malware payload (AgentTesla)", "value": "007a6e1a4adca85bac7fe0971503e13f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125811, "uuid": "9efe341a-4df8-4ff7-9c2a-94366c607588", "comment": "Malware payload (AgentTesla)", "value": "411ed791fd7a5a894c719d889eb2f3a289dcd3dd575b17ffbdf22a1f76ace2ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125811, "uuid": "da7b48c1-ad7d-4ccd-8fc5-11bda6c4a575", "comment": "Malware payload (AgentTesla)", "value": "b2dfb07fd5d4a9c6cd1a656adf7ebedea6926cad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125811, "uuid": "2a5c24f5-96a6-44d9-a1b9-bba35e662815", "comment": "Malware payload (AgentTesla)", "value": "3b22a17bfa3cfb5494824a1f86064651f2d848d39a08888ba9aaec89c825c1dacfeb1cb8a6b9e0da73714e7f444945a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125811, "uuid": "2bc1bb02-e4c7-44cc-a7f9-189321cb3662", "value": "T1EF05014733805393C416EB37189863874A75EED5DBA1EEAC7986352E1DEB341CE02B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125811, "uuid": "daadcb2d-3a6b-481f-94f1-75e1649e400b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125811, "uuid": "de5d7458-196c-4823-93e7-511435158379", "value": "24576:hiKyPp9AR95y2U2t6iX2iIkLoB7zIPPSHT:4PpKRy2Uo6g2iIk8B7zIPP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125811, "uuid": "8a30b9f7-ea5e-4365-b4a1-2a96577c5656", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125811, "uuid": "3f32e1c4-beff-4921-9378-1330d3e06045", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125811, "uuid": "125373b6-1641-4cc0-95ba-64e43ae0349b", "value": "BBVA FINANCIACION ICO (BZG14963).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15667247-fe77-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629107297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107297, "uuid": "83b51b52-f3d1-4d97-92cf-87319a2d29a8", "comment": "Malware payload (Loki)", "value": "4218e63c7fd46102e971f15c0023102e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107297, "uuid": "27f43623-b3ce-4b75-9761-aa8ec2aa5b14", "comment": "Malware payload (Loki)", "value": "415b10893472bbb91cdb899737b006432302503b58352998f503745b1471e601", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107297, "uuid": "21629b51-faca-408b-ab6d-b1fb00e7a126", "comment": "Malware payload (Loki)", "value": "d9bb7d07a8c53faeaa73358d0f5ed10da84007f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107297, "uuid": "03ed9fde-f8d6-4c99-807d-c31cfaa4e47a", "comment": "Malware payload (Loki)", "value": "6d36e97eb80d270e34ba48c7c5e7bc61ac2a12dc65b1232f6464711e28253f59b32b39035f3372997de947ad53d12cb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107297, "uuid": "9244c88f-ab70-46af-aa5e-836c4e422b0f", "value": "T1F8E4BF7071DB8A96F11F4A702578BD5003B271F3A9C699391B5A614ACFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107297, "uuid": "93210f6d-e009-4453-bcb3-60fd3675c105", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107297, "uuid": "19959cb7-9931-47f7-b1fb-9f9f4b50d764", "value": "12288:mf3bVNrjlHNJZmtiTevk1urm7Yi5JOEPpBja:kxNrjlAGCuUm7YqHPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629107297, "uuid": "79a7636f-c1cf-474b-9bb6-8f6d387a7618", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629107297, "uuid": "b08dad10-7d2b-49fa-b088-fa6ba5a69184", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107297, "uuid": "c3c4f9f6-20e2-4cc7-ba90-3978795f02a7", "value": "4218e63c7fd46102e971f15c0023102e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8dd81d-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629125910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125910, "uuid": "ba1743c1-6887-4de7-a783-04aff0e46122", "comment": "Malware payload (AgentTesla)", "value": "5108a958044cf5e8eb896c2775bae6b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125910, "uuid": "376374ee-ecc5-4da6-b301-10df16d8df48", "comment": "Malware payload (AgentTesla)", "value": "41b00ea19ba974cd77526ebd18f52273fd108134aa6ddcf8336bb7cc19197e1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125910, "uuid": "5415bf68-a542-40d0-941b-362bb32ceaad", "comment": "Malware payload (AgentTesla)", "value": "c22afd11a2c0aabead60b5d6f3a61ee3bc187686", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125910, "uuid": "63f624c4-62e6-4f67-8d6d-2ff4ab20282e", "comment": "Malware payload (AgentTesla)", "value": "c2fb836186b55bd71619b9a5032a44d44c162d5d21f78036f13415d3ee0252c3e35283c299ee369f5ee9b9776405a2a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125910, "uuid": "6ad4755a-0f86-46eb-8a28-040c9242881d", "value": "T1FE05D02FBBC49D14DA720F73EC9E50109AB9DC035A83DB3BA0E07A29587B759D43215E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125910, "uuid": "31ccb029-e69f-41cb-8fb8-9c9835e830a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125910, "uuid": "23b0fa76-c5c7-49b8-9afa-1721bed21aee", "value": "12288:iiqB7jL3JsIO2HK7zVxSkma0VimM5pQIwSx993JjNTEY:iDZC1mZViBzQIwKZTEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125910, "uuid": "8f885a57-70c7-4c34-8fb5-49d5e2efd299", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125910, "uuid": "c1877e3e-b29f-4dae-b1ed-29f2f0b0fe99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125910, "uuid": "40e11f37-bb51-45dd-8506-087190e6e38a", "value": "Factoring y Confirming.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096ae6c1-feed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629157958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157958, "uuid": "8e9ea9a6-2bf9-45ce-86ef-d3922adf6994", "comment": "Malware payload (Dridex)", "value": "13d41295c82eee41a4fe4501cf309bb1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157958, "uuid": "e359e3dc-d680-41a2-be58-dc7fae59baad", "comment": "Malware payload (Dridex)", "value": "42278e9a0589ab2bedb560a070ff7b58350816e6cf99d7f5e8f3fce5814a23cc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157958, "uuid": "6583710a-b95d-4564-9af2-9762605dcbad", "comment": "Malware payload (Dridex)", "value": "b3f96d35c5d65e513ecfc6a032878b061adcc8e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157958, "uuid": "fe78eeac-45ee-4f46-9b81-3878912c50bb", "comment": "Malware payload (Dridex)", "value": "2258b6591ecb378c0304b89ad1c65f3396c4f50ea90695ef933f4ff851aa68d9e7fb9c0d5d03e487fd342898f898c04a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157958, "uuid": "58f6cd00-1555-469f-8765-8da4bd46964b", "value": "T1BC44121BEE5D7A43C80CD7373DAB399207A96F81DB0EB1C234A219F71E141B7879146A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157958, "uuid": "4c1bc1bd-c276-456d-8977-07460ea88291", "value": "6144:QogkLjLhEjIUhLOVeR2jwR2v3d98JDEFnbO7snEgNMu8:FDLZEjHLO42jwu6BEKi5SH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629157958, "uuid": "b53c3bb9-b497-49b6-bcec-792993bd9a10", "value": 277444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629157958, "uuid": "e935aafe-f943-4513-a892-0d86175f54d8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157958, "uuid": "a48f9cb2-f74a-482b-a653-fbaaba19ca79", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.350810.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6c6726-fea4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629126987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126987, "uuid": "87be69af-e38e-42d3-b360-586d68bacb66", "comment": "Malware payload (Loki)", "value": "d597ef39da62e7ae8306c542bf2c2e5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126987, "uuid": "2ee25394-1653-4566-9e84-6feab8de1c3d", "comment": "Malware payload (Loki)", "value": "422cb0f6bdffaaacfee8a7984957c6bd0a8e1d6edd773657a6dbe1a62f81bb45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126987, "uuid": "abf211ec-0f9a-4a31-8848-497bc9a2999a", "comment": "Malware payload (Loki)", "value": "cd9d8b49cf0e264ca9865edd5e54c5efa61dd9c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126987, "uuid": "802924e2-289d-41ad-8f4b-03fdf3f752f9", "comment": "Malware payload (Loki)", "value": "d6c64fc701769bfd5456497e9ee15c148e5aafa3510f7b8d5802791047aa59b1614f9573296a4bd606c16186c1aef0a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126987, "uuid": "d6ab2545-ec80-429e-9b6d-2802a555dd78", "value": "T10435D73915B82B67E079E325EAE45417B3E0985FB225ED59BCCE03A70206F4265D333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126987, "uuid": "e1e63307-3021-43fd-a0c5-95b3870de955", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126987, "uuid": "c98975d7-06ab-492c-9851-a8e863ce29bc", "value": "24576:MNoZKrFYvblhBj/JoqPLDF0pe+oxfIXC:sbyj1aiLZyoVIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126987, "uuid": "3582b41f-6af8-4771-ad2f-7efb1dcf236e", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126987, "uuid": "d9900f30-3e56-4785-ba99-d892b179c9e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126987, "uuid": "8674af05-34e7-415e-bc3b-8510eef251df", "value": "DHL Invoice Detailspdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bcbbca-feb4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitol)", "timestamp": 1629133823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133823, "uuid": "0f9d62ff-eae5-42db-8a6e-618e177bd046", "comment": "Malware payload (Nitol)", "value": "f85b93364a678d47d4b54675dda1abc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133823, "uuid": "4b1a99ba-9bc6-4f9f-84ab-814d231376a0", "comment": "Malware payload (Nitol)", "value": "42525e109fc534ac972d74fcb8c628528ddecc7c124ff1c0a5059139444f4165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133823, "uuid": "8f3aeb36-dfb7-45ce-9224-2b88b4be6154", "comment": "Malware payload (Nitol)", "value": "e03b6b4d0690d66e323868e1243b32e2af947b0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133823, "uuid": "53e64e40-7275-4d8a-b5a2-6be94fb7dfb4", "comment": "Malware payload (Nitol)", "value": "99d93acdb9970e2d631521ffe2d3e6efeb4bea8b386595bb156578d718690c32a7b84ea8471252afcb2a549236417b1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133823, "uuid": "7d2aa9d4-2b6a-4d57-a5ec-1895fe77cd64", "value": "T1B854E01D799FE875C3963230447387AC46799F10EA5305BB2F482AAE6F30FF1522635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133823, "uuid": "46961c2e-c40b-4eb5-b0f8-26907ab8b115", "value": "894d0e2453b674d7fa4cc3ff89ddc063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133823, "uuid": "2ef20578-c80d-466a-8d58-6be4f9efea68", "value": "6144:OKrLgPF8Q6JOI8WCjYd2XGSa/oZrUf0c/mH8M:OqkPaQ6JqVY2aAS1C8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133823, "uuid": "417e5fa1-896e-428f-92f1-9bf872cefca8", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133823, "uuid": "53c8f04d-4c6d-461d-859a-92ac522ad697", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133823, "uuid": "d5799124-7431-41bf-8f6a-af4eca716cc8", "value": "mixazed_20210816-155711", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f8bf2d-fecb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629143613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143613, "uuid": "13cd8056-7ffb-45bf-97cb-4e2c52de9c68", "comment": "Malware payload (Dridex)", "value": "a7dc2a5a6f629576fcff7b9791ff3ee3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143613, "uuid": "4c45f5b3-289f-4e54-af05-80d3b5535ade", "comment": "Malware payload (Dridex)", "value": "426946d8ed48e925bab206bab04553b9701327f683da4ef385e2c475b377b515", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143613, "uuid": "c239c8bd-2f29-4904-b4f6-d0dc39995715", "comment": "Malware payload (Dridex)", "value": "6d0a818934d7d5489eaa15b77d79a63fbceb158b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143613, "uuid": "174894a7-1b24-4c23-9ea1-0efd2ce7e035", "comment": "Malware payload (Dridex)", "value": "2c0f80267ef2aebaea3cad80d0e1f7fe7b2d81ee827ec33ead0cd066c474bffecf4033d12c7812f2d50178c296cf1353", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143613, "uuid": "2b840eb6-0887-469c-b4a8-f407ec474521", "value": "T12E44022A4271DA74F957A4384CC52FD82BB58F3F05906B26FBE1E02D9D0ECE3259458B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143613, "uuid": "12e7de82-a129-4add-a760-ab658e7a2771", "value": "6144:StNSLcq+YXEsJup/asVPNdPWokl1DqWjgdFcbHUE:CPYXEsJupCsFdeokX+/dF0HUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629143613, "uuid": "151bccd9-0536-4bdd-8a11-7b98e2b915aa", "value": 261134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629143613, "uuid": "5e7ad22d-af4c-48aa-834f-8130e52794f3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143613, "uuid": "e1db79bc-e2d6-41e2-9a5e-de501238004b", "value": "taxve_4484947_20210816_35710325_768840343.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80e8b9a-feb8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629135514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135514, "uuid": "bac5442b-f40b-4a35-8aad-484daeaf155c", "comment": "Malware payload (Dridex)", "value": "8005bf9346cc1cccf6bff65649d4d8f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135514, "uuid": "496f4053-c22a-4a08-95e8-f83166949ff5", "comment": "Malware payload (Dridex)", "value": "42da374b203106b74b9144de5efb3132bc161e5a641b85ce53fe576f8bfc6201", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135514, "uuid": "1fd60c0f-7cf5-4b49-abab-1b0e13b6ab4d", "comment": "Malware payload (Dridex)", "value": "7a518415cf064cc0ad97fa33a1b9cf5d28838ebe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135514, "uuid": "f2e750a7-fce9-4a1e-960c-e0e094dc1a1f", "comment": "Malware payload (Dridex)", "value": "954c6f865a3f360b2d57dbd680259ec25ccd8202cbe28003b0f695e93af39ec35f84e65faac3fa4123875d37623bf7d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135514, "uuid": "3c19b0d2-0b77-4e50-b85b-90d565c85652", "value": "T1E66401565257E59CEA5F7DBD5CEE21B42FC8CEFE0900392F21F0B62CE6C428A2D19485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135514, "uuid": "bb00c64e-7a9b-423a-abfa-406e846aa08d", "value": "6144:SqtZbAPPimNA/kjoitk6SfeKHKrPtZXrTTBGpmVVvjkUdWtc/7tC3C:7tZbAPDNAcMlfs3XHTBusvIUdVgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629135514, "uuid": "b53be9b5-e06b-44a5-bde0-1e9fb3bf6fb9", "value": 321957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629135514, "uuid": "7d48fe95-d987-41b3-8979-c1d02b431e93", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135514, "uuid": "4dbc1fe3-a629-400c-a90c-fb28db0e95c1", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_4_731539951.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56ca3e0-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629126007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126007, "uuid": "afc625b9-3e3b-43ad-8415-fbe8a698c65c", "comment": "Malware payload (Mirai)", "value": "184305b20a2448acbe0564db8e7479e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126007, "uuid": "d8dccb74-f7d2-4e5b-9341-61c533aff3f8", "comment": "Malware payload (Mirai)", "value": "42f5dd1367f0ed8b784247fbcb19769acbadcd223a1e2d15373ca2f8a305fac3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126007, "uuid": "a4410c5e-2fcb-468e-a2e7-8f6f8f82d360", "comment": "Malware payload (Mirai)", "value": "9a6614edec4668b2b67a4df0ff184149f117ba86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126007, "uuid": "e79934e6-ab7c-441b-af52-4e35b5d471dd", "comment": "Malware payload (Mirai)", "value": "343360820c8b078bb1b761ff7190e0592e267bc3a7150093297fe2f624b520959603797a03800e9e10df91290b4fe1f9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126007, "uuid": "89dce896-7284-476d-bdd8-1b5a67256778", "value": "T1F6630782BC80E626CBC01677FA5F418E331567D9E1DA32469D161FA07ACFC1B0D6B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126007, "uuid": "19d52c4e-8cf9-4b67-8e5d-06d5fc92c0a9", "value": "1536:b4blEKw06Z1XjuxfEQ2qm5YB8t46zHM6k2JM:b4bllw0Wc0484EHvk2JM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126007, "uuid": "6c0614e7-6136-4a1f-b755-da0172a39f9c", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126007, "uuid": "d12664fc-ee89-4f2f-876e-16b3e49e042c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126007, "uuid": "ba6e7bbc-fa9d-4083-a33a-c3ac5b33fd43", "value": "94VG.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1caf65-fe93-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629119635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629119635, "uuid": "c3ce52cf-425c-4c5b-8adc-c7571e42425c", "comment": "Malware payload (Loki)", "value": "b6299d44de6b3bb38cc36b0b43f3415f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629119635, "uuid": "b56e35dd-c971-471b-bbb4-14e847132068", "comment": "Malware payload (Loki)", "value": "438133aadb52985fad58cbd49286f2bcf0fb3d38b36168cd17502be348344644", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629119635, "uuid": "6d1a5e2c-7234-43d8-8758-ebafb5f967b2", "comment": "Malware payload (Loki)", "value": "0d60e51fc0d33c48791fecc49cf09081a2c679bb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629119635, "uuid": "7644a1ef-b55d-4437-a643-21548dfe6801", "comment": "Malware payload (Loki)", "value": "95d64d23063be59193e563a6a7fa2a7989e85e63e34a990343571cb6928bf91e2da62355ed7302f720ba25d616a09439", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629119635, "uuid": "859b4821-2d84-43ca-85ed-1a4a30425bc1", "value": "T166551267DD189E87D42AC7FCBF030DB82B4E161AA9827BEE05314E9A3F412640D5F16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629119635, "uuid": "6f59af55-54d8-4f38-9406-9aceb53ec862", "value": "24576:eaGqxqq0ya++ywniR7q+kHW6rPHwj+tRTL9T8ntJVQArYbnbN5:cqzNa++TnG7q4WDnytvQdnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629119635, "uuid": "fbe8239d-d194-4829-a9dc-2df01c16ef4d", "value": 1366543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629119635, "uuid": "c0a068e7-edf4-44f6-8b2e-88cbcc185299", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629119635, "uuid": "807dff82-ad93-4f3e-97a7-d8184a2d34a9", "value": "Payment_Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec9effb-feb7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Neshta)", "timestamp": 1629134828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134828, "uuid": "d742251e-7df3-4c49-87ec-8f81920ae519", "comment": "Malware payload (Neshta)", "value": "33b294581e9bf726febdbeee1b439756", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134828, "uuid": "b9c77665-d172-45b6-bb1c-333e74c6facd", "comment": "Malware payload (Neshta)", "value": "44447e8ee66daa872048fcca50842694d35a78e77cf9d6ac8e8e4979958d46e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134828, "uuid": "4958adab-baf5-42a3-a405-5d5f4b89ee9a", "comment": "Malware payload (Neshta)", "value": "7110833f44986cfb84a83ab61ff39ee329104c24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134828, "uuid": "8d7fe3e5-745d-446a-bdab-a9e093bc3bd4", "comment": "Malware payload (Neshta)", "value": "f1541115143f5caceda4f8577b0719624cdcdfc501b807b4449d05878f5495c1bad6627be09783acb517522880050704", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134828, "uuid": "c60d6500-321a-42a5-90b4-1c0fac34196b", "value": "T1F3A4D012B1E0D031D46205B449F093F9B87CAF30272E55E7E3985A7D9E787D1AE34A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134828, "uuid": "4645a4b2-83d1-44f5-9e62-f432d41c5238", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134828, "uuid": "08f6b3eb-6027-4538-837d-df081c821afa", "value": "12288:nw8wxL/DKWKYBUu7iE6zQ1qmbGdfvZxOuy5GefM:nCl/nKYq2dqmaBOumGe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134828, "uuid": "7c54c854-1f62-4672-bd75-a294cfd57e98", "value": 477348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134828, "uuid": "5ba00346-49a8-4426-bb29-e910d169ddfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134828, "uuid": "bc833b97-ec64-464e-b490-569c08dbe327", "value": "Swift_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c95099-fe9c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629123210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629123210, "uuid": "0a9f76b0-e779-4266-9d26-536a4c5d26b9", "comment": "Malware payload (Smoke Loader)", "value": "950f966f12a83d04f4293ada9a3d6c9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629123210, "uuid": "29b735c5-c7a4-44a7-a320-701b7e41f3d6", "comment": "Malware payload (Smoke Loader)", "value": "44e3a5d07ad41e0c1e023eeb97798f0822d706abb3406b61466d32a7d29c8726", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629123210, "uuid": "ea238ccb-03bc-4726-b2df-d24bcd3bec27", "comment": "Malware payload (Smoke Loader)", "value": "d73f6178f510a5eedc1a67008d767c47405ab139", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629123210, "uuid": "63195574-a6c6-4265-8997-ae8da935b0ff", "comment": "Malware payload (Smoke Loader)", "value": "f79d7dec670ffa1ab2cc5ded1f37d4da2f246cae2f458de40aeb8ecf18f9b9d8dc3d651c10fa8265ce6149fad510cc47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629123210, "uuid": "33e8563a-1f77-4508-a24f-2859affd90c2", "value": "T11A058C26E26184BAD1D64F799D1AB968E8037E115B39244D7AFF3F896F3C250383C067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629123210, "uuid": "e926b459-d88b-43e4-859f-f8718d94f1bd", "value": "1abe4551dd4f8ef04deab38d0027e326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629123210, "uuid": "5e4a3a88-a4e1-4809-adf6-305e79101ef5", "value": "12288:WhxUck0fyI/Xv94r0umLKC+pvbIAsrxPD+o8wcp:WhGdkF4r0uvnDIF5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629123210, "uuid": "cf87ea0b-7118-4d35-b008-6b6766cb8ea8", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629123210, "uuid": "a1df8e2c-a17e-49c2-bee4-865b25ed0985", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629123210, "uuid": "02dbd103-6a91-4cec-b30b-df9f07460322", "value": "950f966f12a83d04f4293ada9a3d6c9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5648ba-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629126024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126024, "uuid": "578eef1f-56c9-48aa-99bb-adbf3c353961", "comment": "Malware payload (AgentTesla)", "value": "36caa90ad7983f4d019e45ffe4563f96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126024, "uuid": "60b300c8-655e-44c0-a7c7-de9a84baf0cc", "comment": "Malware payload (AgentTesla)", "value": "460466b4bd3a9389f45e255c2dc48bc49f59cea7ed45f10f1b052442bb8e8175", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126024, "uuid": "2bc74e3c-b729-46c4-9331-0235d3df0333", "comment": "Malware payload (AgentTesla)", "value": "375af942d0e826b9bdd8213284790f3f88695f6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126024, "uuid": "58630214-f356-46b0-8590-025f837b5b20", "comment": "Malware payload (AgentTesla)", "value": "e8f0c10c4a3b826b07a0e714d61746fbeb7e74c7a1afe05495c7ec394975a2af09c701e80ec506a289c5d5aa8c1675db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126024, "uuid": "2d197ad8-1ca4-42a5-a8ee-5d92ab2ec228", "value": "T14035823C29FE263BC0B6E671CBE28813B00568AF7121AD5594C7172E5326E5376C727E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126024, "uuid": "426e77d5-ad24-4ccd-a20b-7592fe2d037a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126024, "uuid": "0841806b-9624-4cf1-ba5c-2d40be2910ea", "value": "12288:cne8ES7hCJH213UvLYu6fMxnbsEBEXPCtnJUcVpt34gv0ZGmgkddP63FRPRVmn:IEzJ64k9ExbsEBE6tJUcVpt34I01gkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126024, "uuid": "775d47b8-f208-4d2e-a6bd-1f78c976126a", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126024, "uuid": "ccef21e5-c306-4552-b3f9-af3499d8feb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126024, "uuid": "59ad12d1-f387-40d6-a666-cd04986651be", "value": "COMPROBA.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb809d55-fea6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1629127870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127870, "uuid": "765b9fba-61b0-495e-b8a2-5f5f8d8cf8e8", "comment": "Malware payload (NetWire)", "value": "786bdb27f2eca2315e8c36302630dab8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127870, "uuid": "dc832266-4cee-49a1-a460-47b6681ce5ac", "comment": "Malware payload (NetWire)", "value": "460834ec55aa694ab0d984921534e5b7111bcb024abb36f7bace052fdeb448e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127870, "uuid": "01bf9fab-8453-4505-8322-8675979a6b87", "comment": "Malware payload (NetWire)", "value": "5522bef42cb4d78d5a3096383cf7300513b4e142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127870, "uuid": "f5943651-3e0b-44be-b5a2-67557350b305", "comment": "Malware payload (NetWire)", "value": "683af6dfb0f36e77c53e9e275952098badf8957714499c49d42652630029989739f7d66c2a51bfa1d8c48a22d165a07f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127870, "uuid": "6e99448e-f800-485d-b7a1-9a89c16fa2e6", "value": "T1F9058B26A1836C3BD27317389F469FD0A8197F909AB890472FE57D844FBABA33435153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127870, "uuid": "cddbf640-e241-4525-96a8-dd80d10ff40a", "value": "1abe4551dd4f8ef04deab38d0027e326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127870, "uuid": "653bc1ea-4e4b-4bda-a091-999305e2d244", "value": "12288:WhxUck0fyI/Xv94r0umLKC+pvbIAsrxPD+o8wcb:WhGdkF4r0uvnDIF5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629127870, "uuid": "59f712ff-894a-4809-8628-fe1602b6aae9", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629127870, "uuid": "2c6727f1-69a6-4044-b76c-0734c53329ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127870, "uuid": "719847e4-3ef3-41da-be0e-c9d2b78c6aa0", "value": "Npzdfpgyvnitjebdxpoisvsjhvditiiqeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e729e4-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629126089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126089, "uuid": "5d258861-b9bc-474b-9e79-338d08a7e1fd", "comment": "Malware payload (AgentTesla)", "value": "163b5f458cb4ba9abe922e06f22490b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126089, "uuid": "824c9fae-a011-4c76-aac2-44505495fdaf", "comment": "Malware payload (AgentTesla)", "value": "4641c24b5dab522f1907c0f3b4a6649be1dd0723f13b86fab48b01f084d1ffa5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126089, "uuid": "e9dbe3e2-af97-44b9-a0e3-a7e66069a1c7", "comment": "Malware payload (AgentTesla)", "value": "d4bb568466a488be1a63e76526c4b64d46315daf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126089, "uuid": "13e958c9-7312-4c32-ae60-fddc0b207051", "comment": "Malware payload (AgentTesla)", "value": "23db8e1c00cec9634fd5434ce3ff25e1a6e601f636c747781882b3890fdea73b94c9d3edd0f3225d54dd82e1d10efb53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126089, "uuid": "03fd77d2-be84-4bcf-9b9b-5c74cf795a65", "value": "T18155E63915783B27E079C736EAE44413F2E4EC5BB220D9596CDA23AB4252F5275C332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126089, "uuid": "ae69fc7f-3203-414f-9309-df8c4ccb9716", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126089, "uuid": "07e0adbd-32cc-4525-bb2e-2360bb5050e6", "value": "24576:HX27nHIOblhB2iYcrlOq2kERjF20xqZWpJvZmFVG:HGh128pOq2TxqZqJkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126089, "uuid": "f057db8a-a962-443d-a28f-2b85adfd3d7a", "value": 1324032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126089, "uuid": "f1a4274d-8449-476a-a527-e4612f1993b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126089, "uuid": "bd90a18c-6667-451d-aee4-43a8390c8c6a", "value": "Comprobante_79433161.pdf__________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc1ea18-fe5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629095393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095393, "uuid": "7dec0470-07fa-47c2-b292-8f019e9677f8", "comment": "Malware payload", "value": "e0cfa24ea84cacefbb1d39efd3a235e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095393, "uuid": "24e1d5b1-c3e5-43a0-86f2-5ac055502256", "comment": "Malware payload", "value": "469efe87fef9240720a2c170db6647e92fb1dd148129d867a3065f8cf900b289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095393, "uuid": "2706bd1b-7bab-474c-9d1f-e9d371981019", "comment": "Malware payload", "value": "ddd1518acca734322ff8a5bbc797327ae3eade3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095393, "uuid": "148d0dd3-3321-4971-9cb6-d053f4be5e47", "comment": "Malware payload", "value": "4c294f8c539ec4933e6e820acfbd14fd8fb909d5138a9094466ebee0c2771c3634e97c24100bb448e1e41e6597026ece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095393, "uuid": "aa44af39-265f-4d71-b5d5-5a2ade64cf60", "value": "T1D74415C66404BC0EC2C472F58FA1D5B0DB2CAF98AD07B9622DFC6E5B75AD1036385326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095393, "uuid": "eb3310e8-5786-4848-b623-e05ede655197", "value": "1536:pU/hNCYYMDP/V2KO3EMBsl/iWqINx9lg1fFf9vwEEgE5pvkPCjE7XtJU:pCHCYhHi30rqINx9la9+gE/sPntJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095393, "uuid": "151af562-0b20-4158-b37c-c56838919d2c", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095393, "uuid": "ebf69d7d-2c36-4d1b-bab9-153ae9a85236", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095393, "uuid": "c3e78770-f808-4318-a0fb-c90fc8f1ec37", "value": "Abu Dhabi EM SHERIF CAFE WEST BAY Attached Equipment Schedule and Drawing for your reference.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc22b2b6-fe67-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629100813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629100813, "uuid": "cbf13fcf-d1af-477a-b1fc-612b53ad086d", "comment": "Malware payload (DanaBot)", "value": "998930cd0a9d89d4d7ed82132271bf61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629100813, "uuid": "3bd04495-b346-476b-beb2-85b7a9eb2695", "comment": "Malware payload (DanaBot)", "value": "4773c2edf97089e1ea3108cb675777b870020f5e3082dec8a89a3bc5a2297c1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629100813, "uuid": "89f813c0-626a-4ab2-9805-4b309ed764da", "comment": "Malware payload (DanaBot)", "value": "25bfd30344c52bbe22aa9051cfa05384e290180d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629100813, "uuid": "ca188032-2f57-4a05-895b-ebef83ca9097", "comment": "Malware payload (DanaBot)", "value": "fe1c199ee05d76d08d171221273c1697b0c490120933e3cfda83cc738671c6c379d0ef6b3aae7b3ef2a70febfc49b281", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629100813, "uuid": "c94f95ad-b91f-4993-9168-eeac1f169e9c", "value": "T14435233DB1DE9024C70E74B18473C7DC2A6EAB50D927043793E476EE6A78DF04AA8752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629100813, "uuid": "cd505caf-82fa-416a-8a3b-a87475417953", "value": "894d0e2453b674d7fa4cc3ff89ddc063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629100813, "uuid": "c2fd6813-55b8-41b8-b778-e717063ff090", "value": "24576:qzKSkRPg8PeU3aYN0yCP9R5SDGJMm4zrYo3O4nwuMuK1LIU4u:4KRPZPeU3wtyGJMpK4wNN1LIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629100813, "uuid": "6db37e49-4499-420b-b769-aa8c6ea212b3", "value": 1123840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629100813, "uuid": "fce56362-32bd-4861-a682-decc4169799d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629100813, "uuid": "6cac4990-eebd-493f-b0aa-d052260dfc6a", "value": "998930cd0a9d89d4d7ed82132271bf61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40bdc89-fea6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629127830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127830, "uuid": "04076e79-4838-4bba-8b71-406940d37184", "comment": "Malware payload (Dridex)", "value": "099650cd133fdeacda04a6d25298cb9a", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127830, "uuid": "bec2510f-52b7-445e-908d-5ab97ad4dbe8", "comment": "Malware payload (Dridex)", "value": "47e481a50be1cf0937a2000b1171251c5e5bb34c0a0327e79f88af07d7e09f2c", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127830, "uuid": "9ba22802-8d7b-4621-8a7d-1db3bddc4520", "comment": "Malware payload (Dridex)", "value": "285e9174a6bf809d4b4919d024b2b2043c52d366", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127830, "uuid": "873517c7-7419-4b17-ab60-d27937eba22b", "comment": "Malware payload (Dridex)", "value": "048102baa6c2b45f0554ff60c0d94b266a6b40f47b0271d660245ebc5d33b0097dab1cee849d9dd4ba2318b157bf18b2", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127830, "uuid": "e6756cee-f4af-49e9-92e9-ba0395a2b428", "value": "T1F614CF17E343F2CBDCAE78755016B222D6D4F518F338C59AFA89CB61F18B5A0E934246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127830, "uuid": "892b3059-9c5d-41aa-80b9-035cb4b316aa", "value": "094b06fb8a1e730ce67feae9850a5661", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127830, "uuid": "f9117b90-b599-4248-9f8c-1601834766aa", "value": "3072:94uB6e8xB/c+YvKWg+aQev2gujayP1Ep/eAAYCymnKDj:CuseY/cJ3g+LOOayPGp+lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629127830, "uuid": "dffd3802-053c-4a69-acf7-4435798069de", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629127830, "uuid": "687e6082-ce23-4a73-ad89-a71ca51c966a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127830, "uuid": "b81fd6af-8b69-4b86-aa05-47ea0d7233d0", "value": "222_mod.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d0248a-fea4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629126942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126942, "uuid": "c58777e2-061c-4e67-8fea-be16c5233899", "comment": "Malware payload (AgentTesla)", "value": "6c391e9e28c14dbf27a172f2fff79a3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126942, "uuid": "43779eda-d0a2-4e95-964d-673f3efa45fd", "comment": "Malware payload (AgentTesla)", "value": "4801944ee6259b40006dd85a8505e1cb4b749898c4c49a4b1e89a5fc031baeba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126942, "uuid": "0da4d17a-c4f5-48d0-96d2-f7f0a6493906", "comment": "Malware payload (AgentTesla)", "value": "2902f5b6bb5a96eed46540e10c533d7bfebf156d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126942, "uuid": "0388ad3f-2cf7-4a82-a9c1-c281352c5da9", "comment": "Malware payload (AgentTesla)", "value": "4e789dc2e4050e6fc1fb338e7641fde8633efbce0f145a150d8ca7660b184aed562d4662433334aa95d87397c4ceb138", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126942, "uuid": "5f489c93-acdb-48a9-95b0-0bd1ff22f4e0", "value": "T14945E73915B82B27E079E365E6E44407B3E0A85FB225ED59BCCE13A70216F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126942, "uuid": "8a7d308a-4568-4815-b1d4-ecef4165bcd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126942, "uuid": "dbc716eb-b227-4648-8302-7c040bd8f712", "value": "24576:tzrXdFYfblhBXMSqQZB5fge9TRfGuiKOeQwF:VJyz18Ef/OuigVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126942, "uuid": "20a3a87f-f467-48c1-be02-a3b7c9bf24ef", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126942, "uuid": "bf7f9fa8-4db7-44c5-9e35-3a7a2449e1fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126942, "uuid": "70667c46-e0c7-4290-88fb-ee94d3a3aecc", "value": "hesaphareketi-01.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8a8a7d-fe83-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629112629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112629, "uuid": "5d7e82e1-b0e1-43fa-a7a4-5114d7edf977", "comment": "Malware payload (Loki)", "value": "0ad2bf4388ff61531415d9aaa2725eab", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112629, "uuid": "c1f6865b-6583-4bcf-ba46-3ac31b4dd8da", "comment": "Malware payload (Loki)", "value": "48bfcfae1c10c6db1d6d0d41a38b2df19c6b032af3e0ecb0eee89e62b14605ca", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112629, "uuid": "9a806085-b49c-4cd2-ae22-fe4c73aa50a8", "comment": "Malware payload (Loki)", "value": "99d43c3baace35feb32ebbc253c978f7fc685ae2", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112629, "uuid": "09a1a0d1-61d8-422a-940b-f66530199615", "comment": "Malware payload (Loki)", "value": "f2a0d26653fb1523d30d6e0cc0d83cdba5fcf60fdec18322cd203750a92578ab3741b1c938f2b4464e1813fcbad395eb", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112629, "uuid": "f23f3a80-ef44-44f3-a47e-17b03a094824", "value": "T17655BF7171A78A96F10F8A742578BD5403B231B3F9C68939275A6146CFEDE983F4820F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112629, "uuid": "f485f71d-7981-4bfc-8d9c-feef0e97d13b", "value": "12288:XKftcn1U5MePFzpZJXj/6bRhQOwyOYuvbbTCQJ95JOEPpBja:6ftc1UacJGbRhQOw/bbbTCs/HPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629112629, "uuid": "114d0de2-f3b2-4dd8-bb78-74d3366fad7c", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629112629, "uuid": "0c112df1-8dbc-4884-9029-008e114ce577", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112629, "uuid": "1ffc4671-dd84-4f63-b731-ce184186af6e", "value": "RFQ REF AMOCT132020-B.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374c56d3-fee1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629152881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152881, "uuid": "78ca5640-d00f-42df-8b77-672216fe5bad", "comment": "Malware payload (Dridex)", "value": "96a3b86629145f9cde890fa142e839c2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152881, "uuid": "f12617df-335a-4d0f-8419-5091983b8d81", "comment": "Malware payload (Dridex)", "value": "493473d97655707584a3999e69c02655d17811f9404ad06304da7c7c59014b73", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152881, "uuid": "687087bf-4a4f-4e21-b4d2-a867e9854a3a", "comment": "Malware payload (Dridex)", "value": "349ebab6eaa17ccf1495fffa7c4fed32d44045f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152881, "uuid": "36b148f7-edad-497f-8eab-91b97ecc98b2", "comment": "Malware payload (Dridex)", "value": "0eac904283ed884f0e4c7e6d1b9a47a9650b410f5ce8ceaafebcfe828933efca461b39d24dfe55b3f5fa8f75b8543db6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629152881, "uuid": "d43abbbf-0d91-462d-9d77-9cf26de7534a", "value": "T1A94401516593E54CFE9F7E3D8CEE10742F49CDBE1940292F20E0E91CEEF02A12D6A186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629152881, "uuid": "6c9d33c4-d768-49d1-8ed7-e59b541bcae3", "value": "6144:SUtZbAPPimNA/kjoitkvJI5Lhvu9ZLgzBRDSI/qOMcMsAB:JtZbAPDNAcMfizaZ8zB1NMsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629152881, "uuid": "a9d02a2e-a143-4520-8b9c-5e1bc2ea230d", "value": 254120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629152881, "uuid": "c281dfb5-b0a9-4fa0-b1b2-84123e1bd1e0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629152881, "uuid": "487ee1e9-6666-4b9e-8048-3a8f584ee4b4", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_8_445514926.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7ac6ff-fee4-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629154180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154180, "uuid": "0c4bce49-bacc-4d86-a733-7a9364a2ef9b", "comment": "Malware payload", "value": "0ca116299ae13d37e2368d09f208fd2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154180, "uuid": "8ea0035e-d74f-4ee0-a752-7180fb2845df", "comment": "Malware payload", "value": "4934962518447fe675fc3e72322d7e8eb1521bddcd45eae280f98d0b4d138c01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154180, "uuid": "24894ae2-eccb-43a3-bdea-96556c944dd0", "comment": "Malware payload", "value": "b403ff7c05dca6e6ed877045affaf998f06d0cb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154180, "uuid": "744bd2d3-8ea9-4bf6-915c-df46e66f1b36", "comment": "Malware payload", "value": "acc7efa83d77df35c1044c4491604ae703cb4d100151ae81cfb6c1068597b95ca15b94b92cf8d801a650a2c3796057c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154180, "uuid": "ecb954c8-bffe-4b90-87ef-c9ea0217a035", "value": "T1EC84F11DB58FD472C38271300573C7ECAE6DAB50E647097B275866EA6F30EB08A76349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154180, "uuid": "6083fe74-6b5d-4616-989e-0ea8853b5ea3", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154180, "uuid": "d1cadadb-1eea-425e-af5c-9f7cddea6912", "value": "6144:CLKsmMA1zQULl9z6mSXMhAuyygEdbHLmDHIDR/AI7c/mnUIqq:CWsy6RCg2iC/A1RIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629154180, "uuid": "27c0d9e0-02e3-489a-b992-fb61ef94c1e0", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629154180, "uuid": "6cdad407-5bb3-4ff0-9c12-b44bb62ce59b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154180, "uuid": "26190eb0-beda-494b-8090-347b6d5ce361", "value": "0ca116299ae13d37e2368d09f208fd2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebb6550-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629126077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126077, "uuid": "5a5785c1-f0ca-48aa-9841-4dad9628a684", "comment": "Malware payload (Formbook)", "value": "e6b9de7c84d775b68e36e8b9d3dcd99a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126077, "uuid": "297d151d-d433-4cc7-bc84-5e5b073d9c29", "comment": "Malware payload (Formbook)", "value": "497d83f4debdbc49d2cfb27433de383cd4aac3061bde01e4799d0274a3ef5615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126077, "uuid": "0e232ebd-bc77-4873-acf8-ccc6be51d11f", "comment": "Malware payload (Formbook)", "value": "2d03385ccee21b0f95352a3ccf9fd03607de2e2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126077, "uuid": "47a98d12-1370-41bc-95ef-535b21c71bf7", "comment": "Malware payload (Formbook)", "value": "4f3294b206746925c77b24dd096607f39da01d56b337baad4700979540e83a370f493c67641b2110fdf56a983a734cf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126077, "uuid": "8fae8006-6c31-42ec-99e7-eac8bb8b6b28", "value": "T15294D011B590C031D4A204B499F493FA7978EF70272F54E7E3D45A7AAE316D27A30B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126077, "uuid": "d7a9cb0f-7494-4b68-a1c7-dc18d5873588", "value": "53c59b75f4f7c3e4cf3b5a4fc5238353", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126077, "uuid": "78a1e054-af43-4faa-b669-34c2dccf63dd", "value": "12288:bfxw8wxa3DKWKYBUu7iUmNqNEZJyfJhIMs/bcvui4e2:bJCE3nKYqW3EQJWMMFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126077, "uuid": "bbcb7626-c150-4001-bf72-c3e21ffbf0f2", "value": 427255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126077, "uuid": "0a15c67b-5e89-40e1-8719-5a9b573e158a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126077, "uuid": "b57c4a3e-ecb5-43d3-a1a8-7e9b2952b782", "value": "rck7709123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7aee7d-fe8a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629115439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115439, "uuid": "9a03b994-d860-4f95-b1fd-9fe226bee99b", "comment": "Malware payload (Smoke Loader)", "value": "ff93fc1a843522b8b959086a642f3675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115439, "uuid": "5aeaf75b-c4c1-4ad0-a370-e51d9c849a77", "comment": "Malware payload (Smoke Loader)", "value": "4aa5d31d20f0fd1c34a98270119339269fb7be574e580d7a21da7ecb3a59f471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115439, "uuid": "c7989b68-62b6-4ead-9a1c-5036e5059faf", "comment": "Malware payload (Smoke Loader)", "value": "035f4c467b5a953444b3b270b51c695095038191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115439, "uuid": "22bb4d81-f2a6-4b94-ad18-2784bbd5c472", "comment": "Malware payload (Smoke Loader)", "value": "8851629617d68c1fc916d531a37b1b8ede0960265637338e862b694c3fda5b2cb5d9f05cccbda4606bfaf8e3815562be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115439, "uuid": "6d3c7b76-9604-45a1-95ec-4829078079cc", "value": "T11604CF2D759FC032C392753184778FAC1AF9EF20DA53097B6788256A6F70EF0466634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115439, "uuid": "b8c3c238-871a-46c1-8801-575830b49699", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115439, "uuid": "55e28ee9-b64f-4ff0-87f9-763949c98cbf", "value": "3072:IELTWW/LnTM1111r1cHbCIckpeBNRTRGc/mLBLZtCZ7yq:VL1zTE1UbC7lcc/mL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629115439, "uuid": "8a50631e-e6fb-49ce-8c57-8ec1bfc99cc3", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629115439, "uuid": "bbe2ebec-5470-4ae0-839c-c32a984c053a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115439, "uuid": "64352001-a606-45ab-b07e-58b2868cdc16", "value": "ff93fc1a843522b8b959086a642f3675.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186f2f01-fe54-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629092270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629092270, "uuid": "fe1e15d9-f205-4995-9689-517d6333bdca", "comment": "Malware payload (RedLineStealer)", "value": "30a64c61e75d116f706c23f451abaca5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629092270, "uuid": "c6701ea9-4bf0-4bc9-bdf5-05eddd467223", "comment": "Malware payload (RedLineStealer)", "value": "4af4a3e76358c3a932e5fa2bd23af3f73880a0f24d0841c299bea7f35dec8283", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629092270, "uuid": "75503f9b-9323-44b2-aaf7-7d9c62ba01f8", "comment": "Malware payload (RedLineStealer)", "value": "ed161a6087975bc583349e5109e2e425a20c11a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629092270, "uuid": "6840ad07-1b7c-4e09-b334-e9dba6f250e7", "comment": "Malware payload (RedLineStealer)", "value": "9275414653059986f07361eefad4650e2e16995c6e31ce8f037c1ddc085d409e5320deb29a941c183b46a1f0f6116e74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629092270, "uuid": "ae0477d8-9ab9-44b9-ae3a-acf356141752", "value": "T1B256333AA1429473F4A11A34198FDA70B879A948BE2C111FF3CD5F1CBE372655E2731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629092270, "uuid": "5f310622-6c84-4d73-b4af-9cf46e83a092", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629092270, "uuid": "abe6a89f-dd8c-40ad-9304-92a99b34a0a3", "value": "98304:gAI+vDWbKaXOp1dFotsOfp8/+xBerRpHXaptins5mXj88ZlW7Xtj7sqXJN6zKT2T:HtCew+2sOfp6+rMKptOHXj88Z0PsqN6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629092270, "uuid": "7b82ebf5-fa3a-4c0b-8c8a-4dd5f64c1d46", "value": 6226977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629092270, "uuid": "2be9560d-69e9-4fcc-99be-9ab10be3d351", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629092270, "uuid": "dddbe958-1df4-4286-a5c2-d4ff865dc62b", "value": "30a64c61e75d116f706c23f451abaca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a478fa1f-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629126006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126006, "uuid": "0c76a229-479a-49cf-a654-35c1c2d9ef8c", "comment": "Malware payload (Mirai)", "value": "3ad46ed38bad5f8b2da2281a45a199ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126006, "uuid": "823e0d17-4700-4956-a00f-f9d0848d5902", "comment": "Malware payload (Mirai)", "value": "4b439379486b4f3ed7f432c143df4dcabd59d02047916900dd7b5559d5b4d253", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126006, "uuid": "2e7c5ce9-4406-41d0-80f9-32ce81727dc4", "comment": "Malware payload (Mirai)", "value": "32a59d1d1570620b69e2c3c5c653f255eafc1237", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126006, "uuid": "9e8d577c-c9ea-4af6-83d7-ea2025d0d7f4", "comment": "Malware payload (Mirai)", "value": "967cb16f12387336f348fdccaa4fb205999da918d6250896f3c631d7af11a81041f457fe5da258976e07182ba953f07a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126006, "uuid": "6e2e2f44-8faa-4996-ab25-c5f514b91a83", "value": "T1CB533AC8A5C3E5F5EC001D793076ABA1A973F53F2039EE8BE79A25739903243E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126006, "uuid": "12d4dd28-a435-4453-a9c6-40e86b629cb5", "value": "1536:V5Vn4pXoqVExGxRP3MFnKivjGKO18HKaPWryjjUnDVQAG9:7R4pxuxGxB3MFnKQGHCHK3c+VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126006, "uuid": "90ed3707-b8c7-4aab-8a24-d7339016133e", "value": 63696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126006, "uuid": "b4b31f07-9dd6-4626-8334-72f67ba9fc07", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126006, "uuid": "fa5bb849-00bc-4acb-99df-d02622c7afbb", "value": "94VG.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aaab302-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629125989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125989, "uuid": "de27594a-ab76-473d-93bc-8610aac83833", "comment": "Malware payload (AgentTesla)", "value": "2ce70d374f5a9602a6c6799d93f8d8b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125989, "uuid": "8d564925-0fb6-4561-9438-0a23c2621b95", "comment": "Malware payload (AgentTesla)", "value": "4d3bdc88707d028624927c54be8b8d6b1fc1b5e1357b67c060a247970475996b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125989, "uuid": "328b0cac-afa3-48d7-b3bf-90b09ec3b086", "comment": "Malware payload (AgentTesla)", "value": "ac3e2787aae6856447c6d70834c273af27a27455", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125989, "uuid": "dfeccc12-dfe2-4668-a2c9-af160bc8c622", "comment": "Malware payload (AgentTesla)", "value": "c5db85b4d36d1928cb98c3211e7747c97c522c0d836c4c766636f132f155cae463905b6d410043109b864771fd832477", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125989, "uuid": "47d82074-a16a-4964-ac46-21c366d152ef", "value": "T11325813C19FE2237C0B5E375CBE28817B04568AF7521AD9494CB5B2E5326E4236C727E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125989, "uuid": "ea4ed47f-5e26-45c0-94d9-1d1e1cd29f49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125989, "uuid": "c91a5975-7dea-4345-bd2b-3f9f34bdc198", "value": "24576:kce6EUFiQI7huYgite9H2ZJ+RiHGFDaOaD:kUEfP7huYgmewyRSGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125989, "uuid": "d19da7ba-79dc-4f16-a04b-d46f14c68776", "value": 1043968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125989, "uuid": "ca6174d7-34cd-4508-a898-cdf18da188c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125989, "uuid": "1e60f243-537e-40eb-990a-f32c84d384ac", "value": "Remesas Aceptadas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee789e54-feb9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629136008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136008, "uuid": "f0d9bc6c-3fba-4eca-9613-c538d64a214e", "comment": "Malware payload (CobaltStrike)", "value": "2a958aaecab5f3c9af382b0dc2aa7377", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136008, "uuid": "eff891f6-3d6b-452f-888e-e116744327aa", "comment": "Malware payload (CobaltStrike)", "value": "4dfc1427db2bc6961228e0b6242b8cc1c6bc34d6c9f2a853aa13b0a7fd76b3a5", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136008, "uuid": "d5501924-dc54-4a7f-b456-73e1cf2715e1", "comment": "Malware payload (CobaltStrike)", "value": "d00c3f6576877c9bd5d1edbd4e1235410a83661a", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136008, "uuid": "5685bf96-6303-499d-b1fb-2e9668c6fb5e", "comment": "Malware payload (CobaltStrike)", "value": "ab2d34deb2c6b578be844b557e3595fcb66965ebf432d28900d6cfe9993ac1c94d600a906c9fe857b15c4f589511e897", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136008, "uuid": "b42575a6-f264-4198-b118-1eb30cdeb935", "value": "T148E46C409845FCF7DC854AB444F112DB82ABA571C729D6FBE720FE38041EE44D9B2A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136008, "uuid": "ac0187d2-246f-4371-b29e-242d9c56b305", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136008, "uuid": "7c80c7d6-62f8-4b6f-a5e3-72e0adf05bcb", "value": "12288:H3rNlxRPfp/DbrfbaE55aE0xtma9I/+3956q7Xs0zfsbP9FTvXhr:H3rNl3Ph/Db36xVS/+395Zo0zfsbPrvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629136008, "uuid": "60ae2354-c2e7-4fc8-9bb1-da8a0c7c1ac2", "value": 714079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629136008, "uuid": "a11b5ea0-d844-4734-92b3-6d344d0930ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136008, "uuid": "b5819552-3966-4e29-b468-0d36cea22a6d", "value": "beacon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718bac5f-fe89-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629115183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115183, "uuid": "7fabe739-bf99-47c8-8fb2-fecfc2e6c420", "comment": "Malware payload", "value": "de32d3a4c84c726a7a2958234b092c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115183, "uuid": "a62f4ae1-61f0-4d49-b513-c9a3fa624455", "comment": "Malware payload", "value": "4e2ae4e82379d7b44dc25a676effbb374118ff501d535cd09957922ec98d1b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115183, "uuid": "d8b6c4e5-7ae0-4696-9b3f-97008ef102de", "comment": "Malware payload", "value": "b4ebb4dec2e811484780ef8340bd854e5c8af4e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115183, "uuid": "98ae6182-011e-452c-a18a-58d77f248f58", "comment": "Malware payload", "value": "b7e83553257b417d32c0daf334d63bc7296f8bba18e475d759996c8f80684da0686816bd1fef79125cb9b21ef333ff7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115183, "uuid": "fca45d44-8bc9-4713-92aa-c977c51f2617", "value": "T12285D0E23A09B6CFC89A167AC427DE0266BD17F447200A57F89D35BD5D43D422BCED28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115183, "uuid": "35a8d152-de46-4935-830e-a205d372a915", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115183, "uuid": "9beebc69-2940-4963-8aa5-487f155e4d6b", "value": "24576:vsOJveGjq6qqU6EoGDrXouYOSKuPM0u5uFVoBVvwOEegRGxxDy9X7baeKiq:X0qU6YrXT57l0uEQ/ZkGTy7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629115183, "uuid": "1eb89870-adcb-4060-9182-873a0a79b543", "value": 1820701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629115183, "uuid": "6d0f81f4-5f86-4244-bc63-2c72e97e967b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115183, "uuid": "0422fc62-c653-4730-9233-6a43f8f44648", "value": "de32d3a4c84c726a7a2958234b092c7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe28c0e-fe8b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629116173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116173, "uuid": "3d127f15-b023-4f18-82dc-95f91fde5110", "comment": "Malware payload (Formbook)", "value": "2b704ce97c3df3b2a4b7fd0a848c9603", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116173, "uuid": "02e0a620-24ee-41b6-85b3-fc3c669a8e3a", "comment": "Malware payload (Formbook)", "value": "4ed49588d6356f63895a1674a3ab5351199e4c4a8af4c825cc7d2b7dd79bffbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116173, "uuid": "fa022b93-d884-4276-b193-9162053801bb", "comment": "Malware payload (Formbook)", "value": "ee79dc6d6f0760614a138494e8a4fe6ff4b5d5a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116173, "uuid": "a8b57bbc-fc86-4bcc-a460-d2f520f2aff4", "comment": "Malware payload (Formbook)", "value": "9dec955342132a998af5a36f67a6972db8091ab0613a247756bb05f7a747e66d31a06f2c8eb9ed856f8e25e90e187a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116173, "uuid": "780b8187-68bf-4eec-a5d0-1e61afbe176f", "value": "T18105CF7171AB8597F15F8A742538BD5403B231B3B9C6C9391B6A6046CFE9E983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116173, "uuid": "2b96aebb-6a37-4827-bcad-05124c516b4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116173, "uuid": "14eec61d-e19a-4ae0-8186-5941900d902a", "value": "12288:PTBYOWDsHgcz9AiPEodT/p+rrlWZBRaZAJNBZfapSHKZLmY5JOEPpBjax:rBt5HgczNHsru7NBZfaUHQHPix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629116173, "uuid": "bc3f38d9-18dc-46d7-9656-a4c07597b8b4", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629116173, "uuid": "45d12401-f1d5-4b0d-b673-b0e5ed0c6c67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116173, "uuid": "6eeb7936-c8f7-4d34-b1c7-393f42353e93", "value": "IMAG0093992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539cb8b4-feb2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629132742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132742, "uuid": "03b4c537-27aa-4aa4-bde4-90b3baa6cdb1", "comment": "Malware payload (Gafgyt)", "value": "f8b3d7ce2820e455743a917f26273f66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132742, "uuid": "d23ceb1f-05f2-41b2-ad7b-ea6b2010dda0", "comment": "Malware payload (Gafgyt)", "value": "4f61e2f91c5afe470132e788ddf2b4a68f768d159685e84b7c6a074c1531f863", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132742, "uuid": "71c1bf11-aedc-4ed4-b01d-80bfd44201d5", "comment": "Malware payload (Gafgyt)", "value": "c5387c2304fc25680be3ef139cfa32e21c82767e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132742, "uuid": "097ea5c9-57ef-42be-9fbd-5b70cd11df8f", "comment": "Malware payload (Gafgyt)", "value": "2248df7c9c682659f9e2adc6d0c8a81364c7cc2ad7668dba5dc4ce5a1bb5697411a5115dafccdf3116511b51ce82d568", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132742, "uuid": "1eb5064c-f60b-4047-aa5c-93b0f5e5796f", "value": "T1A5C3845ABB619FB7D85FCE33059A4902108DE18A12D86F6FB2B4C56CE74B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132742, "uuid": "0ca7f44a-105a-4179-8440-6ae01d21f1df", "value": "1536:wHeTcHuKjHYBZFTxbWe1pwggGqTNpOSmIH/MVOrmW+IFB1Df11hR/:wheb1p9qJY1QrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132742, "uuid": "e72d1d41-8c11-4ef4-bc56-96bef04f8f10", "value": 129996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132742, "uuid": "8f4ef1dc-9c63-4ac8-a8f3-0fc3ffa8bb11", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132742, "uuid": "27b7a553-39d5-4557-b2a6-b5d12b306a09", "value": "f8b3d7ce2820e455743a917f26273f66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249fbbe1-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629104746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104746, "uuid": "31e1b5e3-4a8e-4035-ab68-779075e1069e", "comment": "Malware payload (Loki)", "value": "b3a855b248ac981f2edca2e162d51509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104746, "uuid": "5bf7e2f3-a584-4536-a8a9-637b3e2a2d54", "comment": "Malware payload (Loki)", "value": "4f6d66cea6a8dcd4a29089e58d5adc3858445d4bba816fb2aa6ebc9cecfea68b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104746, "uuid": "7ab1c17b-c01d-4931-800d-0dd77f40c14d", "comment": "Malware payload (Loki)", "value": "d98eac5aa7d9fe044ba0ea1970e96258ce8a2ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104746, "uuid": "5417673b-ae5e-47c0-b9ff-dd59a78cdcd7", "comment": "Malware payload (Loki)", "value": "fc912cfc20df8fe007637bcef1a3309bc11bf07eb15f9389f685fd04647d0420c7ed8867b80cb9b53a589cf10fc1b191", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104746, "uuid": "038d2afd-11d5-4c50-b18a-275efc292881", "value": "T1A8E4BE7071A78A96F51F4A742578BD5403B231B3E9C6D9391B1A604ACFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104746, "uuid": "63a26ec5-0c6e-41d0-afb0-5d71693991c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104746, "uuid": "e92fcc06-d8ae-4390-999d-1a8fdad88da7", "value": "12288:kuVE2anr5O/FoYHYciqIME/vgflTYNEicq0GN/Z9lOWTUwNK5JOEPpBja:JE2ar5FYHz5IB/kRYNEicq0GlNOWzSHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104746, "uuid": "461e0125-1365-4b70-9bdf-269c1aad3019", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104746, "uuid": "48456a60-db59-4b8f-a2c9-83206b96cb2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104746, "uuid": "49d1ed58-05b2-4b57-b6d2-8c7324643c5f", "value": "DHL Original Invoicepdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d618c2-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629132239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132239, "uuid": "a9449832-d169-4d1b-b215-a4c699a3b7df", "comment": "Malware payload (Gafgyt)", "value": "55d2b81fbf862522e170137943671998", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132239, "uuid": "cdb717f8-f5e7-41e2-ba45-9a7c16bcb23e", "comment": "Malware payload (Gafgyt)", "value": "500c3e3ce1c439f870435e5c6bd5439d8615b40f2a02468ca6b75cc1a64d8b68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132239, "uuid": "ddeabc2c-912f-472e-ad62-d1cd97661063", "comment": "Malware payload (Gafgyt)", "value": "66f4d95fa47395970786f61f1e38f24c066bea41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132239, "uuid": "6a45b95d-feee-4794-9c03-98749e2f3609", "comment": "Malware payload (Gafgyt)", "value": "4c7e39574d8a8b49766e7532cfab597866731103b5a1207c38f40eba6c9e90d796911a9c1e7c558ca525ba1bf9a4b157", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132239, "uuid": "0aaa0792-2472-4cd6-bedd-a615d041133d", "value": "T1E2833B43A5659FB7C08669B265AB5D300B13E9902F4F2B49303DA6F4478F5CEB80EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132239, "uuid": "1b48743c-5864-412e-a49e-02fa5c7313bf", "value": "1536:u8KV4yHxjUNkO+FZsDVAmX9uYmpbOSfW2KMwLEjzgCPEdb7OYrzEmkxVqOEeofzZ:6THxjiCsBmpbgJMNgYum5mkxVqODofzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132239, "uuid": "da0e7453-762d-4606-b2a9-85afb70eccc2", "value": 88735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132239, "uuid": "51de0427-b53e-4265-90f4-0f1dcdfc8e21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132239, "uuid": "a39a2916-e329-436c-a360-93cb071210bf", "value": "55d2b81fbf862522e170137943671998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3f86de-fe61-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629097883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097883, "uuid": "9e1c67d7-9a95-4447-b705-8737b0d34bad", "comment": "Malware payload (CryptBot)", "value": "b5f49db3a9a421773d2eeade6f52bb33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097883, "uuid": "135ddf15-06c7-4496-95aa-29bc5a2ac270", "comment": "Malware payload (CryptBot)", "value": "5049169b6ddfd46c25ef01b29a760453ac36534b7e033364a297be7efeaa6fc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097883, "uuid": "5216d636-b2e4-4acf-b627-03eb2a373f9e", "comment": "Malware payload (CryptBot)", "value": "08dfa30ef726c80d85e4d803b348a418cf0cadc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097883, "uuid": "1b119e0e-4627-406f-9536-acc9c40d396d", "comment": "Malware payload (CryptBot)", "value": "e591b8a7ee4b25d81c9c09c03a4b62cd19e1aec09d2347d521383538ac80536d9b86edc23b7c2d3af3c9f8403c59e57a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097883, "uuid": "1f0bd5b3-e572-416a-b7dc-66e064cfc62a", "value": "T1E244E01C768F8072C38335344473DBAC4A79AF52EB63867B1B542A1E5F30EF1857628A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097883, "uuid": "c243ecba-a7a5-4e1b-899e-96ade0df3e1b", "value": "bbd46beeb3d66413f1019ab26c173363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097883, "uuid": "b5ede8e7-7a3e-40a5-92b0-20fbe090206b", "value": "6144:vRLAO5dsfvu4FmAejqCHa/RVSV2RVn+Jc/m/:vREO5r4kAEqJ5VSV2RP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629097883, "uuid": "49ccfc8a-21d7-482f-b9b4-9f26ea4e191a", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629097883, "uuid": "d81cd905-64bd-4efe-aa74-f182efa91e54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097883, "uuid": "da0f71ec-c5ab-41cb-8652-ac8c4a50c0a1", "value": "b5f49db3a9a421773d2eeade6f52bb33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb44b70-fe6d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629103390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103390, "uuid": "6b4695ae-4b78-4714-b22e-4d7fb4d880f5", "comment": "Malware payload (Formbook)", "value": "ce6e63b092cbf8f478c0782ceb9d122e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103390, "uuid": "797c4163-f407-4253-af4a-afdd992349cd", "comment": "Malware payload (Formbook)", "value": "514ae8892da0386daa6f2ce6f4278ebbae597c1165e3c0ec05aa5959fecc180e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103390, "uuid": "b66d3ed6-15a8-49a0-af8c-ec9e283179cc", "comment": "Malware payload (Formbook)", "value": "0e6227575150fad52190973f692ccbfdcdf9f79a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103390, "uuid": "8ce7b19e-c5dd-4f21-93c4-8272d56f9898", "comment": "Malware payload (Formbook)", "value": "e759c4ed4d6f1e467c06d5441e79c8e0b3da4ae702fe7f51bbd5269289dbe4863bb4ce184ca859ec0a08047ad994a69a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103390, "uuid": "69aed963-31f5-4be1-bff6-1329f8953aa3", "value": "T118552378B5199A22DF910BB016489DFC8D18BD2756D151A387AC3BC264F02E39FC4EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103390, "uuid": "c1e39ea0-68e4-4aa1-97cd-6513c34a7309", "value": "24576:XI9Khx7K4Yt0jKOxoR/KLFYd7/4D1MUw2bFavEcfE9i2yuY4H2fR:XaeN5u0+GoR/KhC1F2BsEcfEyusfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629103390, "uuid": "830f1506-0e15-4303-b1fe-be311b5d86a4", "value": 1341576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629103390, "uuid": "98ea5396-26d6-497d-8604-3d1346005c91", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103390, "uuid": "2f912dfd-3e57-4e5d-8508-622d718eb880", "value": "138466490407366483.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c110c5-fe8c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629116294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116294, "uuid": "9d49cb0b-fd5e-468f-9b66-98dc1c5d663e", "comment": "Malware payload (RedLineStealer)", "value": "7be8906b31d19fba436de74f50581c98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116294, "uuid": "bf046a6c-1aef-4009-bb8d-c1cf337e54e1", "comment": "Malware payload (RedLineStealer)", "value": "51852436597bbdbe4160762d2e6148c3785bf03eb122774ab7e4a5aae64a2be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116294, "uuid": "ac57ff47-d251-49b0-b234-ad649dfd2269", "comment": "Malware payload (RedLineStealer)", "value": "5ecbd73398496ae53d77bfc76644faae8287c456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116294, "uuid": "7cc08539-d25b-41bd-b225-c00e68917056", "comment": "Malware payload (RedLineStealer)", "value": "c4e2ca1227effb4851dac6de4d4a6438becf546868680ef10663f3fe29f83466a294405023a043261bc0505a10f9de09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116294, "uuid": "76aa4f32-2096-498a-91d5-401548dd3771", "value": "T105C3F663172C8467C1872A30F1650B07F567CF192687F289F909F29AD83D28DB9BB356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116294, "uuid": "4719b44a-4057-42f6-9fbd-977f1f2ca0e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116294, "uuid": "b367e22b-c289-4168-8780-16d6562c9f34", "value": "1536:qdcyqYPIvFZuOvCIdlnTLsBXeWzcmKO26Dq+:qdHyHLtxKXe9mKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629116294, "uuid": "57b7aa7a-d49a-4a86-8e29-38ba23ee07b1", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629116294, "uuid": "4e074ebd-c4be-4f0d-aa5b-12e2197e40d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116294, "uuid": "70c90f2c-9bee-4eed-ab65-68ab7eb3e8a4", "value": "7be8906b31d19fba436de74f50581c98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d7eb00-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629114356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114356, "uuid": "64361296-4630-43c0-9be5-205ce589069d", "comment": "Malware payload (BitRAT)", "value": "18c182c4077190695fed94110763f415", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114356, "uuid": "b61b52f8-000c-4ca4-b7d6-8c39514b59cf", "comment": "Malware payload (BitRAT)", "value": "51af4d4e1af93fd32fd240a7ec9df52e2af9f7d7567c7f7dff776ce0b4852323", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114356, "uuid": "18c2ec8d-c1b4-414f-8294-4cc74d1e31f0", "comment": "Malware payload (BitRAT)", "value": "9ffd0e64c8bfca6d5357f371beab758be27c77ba", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114356, "uuid": "1dfa7946-a10d-4555-9cbe-3ab4b320cc69", "comment": "Malware payload (BitRAT)", "value": "b666c6d6713027bcf2761dfd543b3e348f16eabb6464279def3cb6a4d63db2eb1c1370be111ab252d711160fbaaae61b", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114356, "uuid": "cd9eb95e-498a-41aa-aa68-41c3025c653f", "value": "T1758533B66AC8C1A3D64B40B50157DFF19EFF0AD0E2A7C54576CC796CDA138228C3869D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114356, "uuid": "66f622a2-d96b-4849-b2bd-29db8be28235", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114356, "uuid": "e1f93173-b072-4684-a70e-1fd44f0a5353", "value": "24576:W90TRM73PniQuHgaEmuGfp11D+vfa+/Cckkbz5xhabm9Q2NGbGBajhX8iy:ldMzPsHgtJGh118UQzzsbmq7qBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114356, "uuid": "5f6436d2-3cd3-4862-be20-275f170c6ba1", "value": 1719808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114356, "uuid": "053b8894-77f0-45be-b67d-7da662b22cc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114356, "uuid": "36c5248e-1f38-4c90-b981-030390f46b32", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d0786e-fe73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629105848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105848, "uuid": "29e4a84a-bc58-4b30-9bd8-b9d56c507135", "comment": "Malware payload (Loki)", "value": "9b3562ae8793887bcb4e644e29202349", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105848, "uuid": "d8349736-7f71-41bd-9f03-adc59c6e35e6", "comment": "Malware payload (Loki)", "value": "5269e07c6514d9e79439746e25f0e44d6ddcec1bc5699cc75eab982a04ba8767", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105848, "uuid": "3373294d-5122-4382-92b0-c2c96524b6cd", "comment": "Malware payload (Loki)", "value": "69c0b367704a0d00b91044cd2bd58efc32fcc553", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105848, "uuid": "ef8dd2ae-c288-4fbb-a4f3-197be01ef329", "comment": "Malware payload (Loki)", "value": "02b0b894aaed47c83436ecabf162e375026ca168ccda3b4e4ba069a30581872c1e849bf9e831ea8093f16d5050a790b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105848, "uuid": "888b1f7d-f5a5-4264-9c7d-a831d595a7d1", "value": "T12FE4BFB171A78696F11F8A742578BC5403B231F3ADD689390B5A6146CFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105848, "uuid": "b25f65b3-6d0a-4b33-8f54-905f7f7fe576", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105848, "uuid": "45066935-8ed6-4fcb-8306-fdff2284cf65", "value": "12288:i3Z5JOEPpCS906wVoZ10TcFMt+fjrBDCEOsxdkDka1Uxa7KACaouja:g7HPDWFegmBosxdkYqU4CaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629105848, "uuid": "dca84c96-2544-4e9e-9d2e-b423deb68edc", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629105848, "uuid": "2e2284ce-845b-45e1-91c1-e60fdfc276e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105848, "uuid": "15e0163d-4dcb-4f6a-ba40-e63aedde8afc", "value": "FW DH-JUN-21 DNCN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02919683-fe84-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629112849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112849, "uuid": "d8701a59-bdc7-47c5-99a2-d936de3d9bd4", "comment": "Malware payload (Formbook)", "value": "e1944a1c43c563a27fa55776fe532c92", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112849, "uuid": "ade9ee37-d21f-4927-b56b-230dec16d580", "comment": "Malware payload (Formbook)", "value": "53b3e974ac26c1e54557d6fb593612a4e0104987d33fa3af574c152629b9578e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112849, "uuid": "04a408e7-b158-4ddd-a7dc-6df9b401723e", "comment": "Malware payload (Formbook)", "value": "b2d5208cc51638458a63d937dccbad6100332a20", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112849, "uuid": "408e710d-8949-4d2a-9b67-69f1ba48bda5", "comment": "Malware payload (Formbook)", "value": "cb8a9cf190bb8efe450c3ee388a4e2abb5a2b6de56390c35d5dfa8b9650e32bc0b76eefeb46d5e712edd4a68a7113b38", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112849, "uuid": "229997be-2ef9-40ca-895a-845283af73f8", "value": "T1924512F1F5DBE36EEE7EB47B155399BE52106D7169F0C253C2883228623ADA6070B1C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112849, "uuid": "db78caf3-3b0a-4ca1-8102-981f38f0c506", "value": "24576:EYUuIfRJ6dzWvQ6qmiezt9cVITpWzBA0l8RCos:EY7IfRJqWvrqmiezDcVITpg8RCos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629112849, "uuid": "831ffc09-48b6-4125-86bc-e9ed5fda0bc0", "value": 1259704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629112849, "uuid": "8cacd0ee-0af8-434a-b0ae-9ac3dba9344f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112849, "uuid": "bba1f04b-0bc2-4462-8173-d3335ed41ab8", "value": "Transfer_form_$157,890.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9f9da0-feb7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629134801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134801, "uuid": "dec0ccc0-2473-4876-b143-a844e9b91bef", "comment": "Malware payload (Formbook)", "value": "e5ae21094595ab97c9143fb1371a064e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134801, "uuid": "e8317088-8a05-48ab-bbde-5ae0ca90274d", "comment": "Malware payload (Formbook)", "value": "5477caa8027533f0f034e0007a2dd9bf52fcb5e2d723bad5200b280806af2084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134801, "uuid": "2c7eb45f-2dec-41ab-a903-ad1050ba52d9", "comment": "Malware payload (Formbook)", "value": "b99dabd56ae3736a79fa76053f14c2d56fe38a6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134801, "uuid": "e8e50e7a-e508-4130-b82a-e05c2feb1d14", "comment": "Malware payload (Formbook)", "value": "d40d60a287b52e9eb772e56e0a28e6af802ba2f2fb6d83373914aa2729c2356fafe18a8530f0f71f19955176759d83cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134801, "uuid": "00d3d00b-bbf2-49bc-8257-fcc9f31f1112", "value": "T1B145D73915B82B67E079E369E6E44417B3E0A45FB225ED59BCDE03A70206F4265C333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134801, "uuid": "f5ecca49-b4d3-49af-88a5-e1cab63cff89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134801, "uuid": "bd75c935-1d90-4b6c-8bf8-23669e4c8aa7", "value": "12288:DOLEfBZCDuTFYJDc9F3nC0Py3gAhMIIalhBNStqU6IQg9IUVP+MZFNuz8KMW9q41:D4CTFYFblhBotrQg9IUsW2YWdhk0P3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134801, "uuid": "1da5248b-0eaa-4c0c-bb66-22eb45dc19ee", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134801, "uuid": "e61d03a3-6ec3-4c8f-8a2a-42406dd36b87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134801, "uuid": "7e5dfdc0-b411-40b9-b8d2-ed28ce8264f5", "value": "#NEW-ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6f3734-fe29-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629073887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629073887, "uuid": "82f9cee2-ebcc-41b3-8eae-1e5c58e1e63b", "comment": "Malware payload (RedLineStealer)", "value": "8fa76cd75fe02c1093f254977f44ee79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629073887, "uuid": "8a0a937f-de0a-4938-9938-c6e2cac53223", "comment": "Malware payload (RedLineStealer)", "value": "54deea77c66f31b5b2ae101d942ddc0acd04a146f1dadf85f80034e1f6edd567", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629073887, "uuid": "cdc386db-b04e-4774-89c9-0f0c47d5f9fb", "comment": "Malware payload (RedLineStealer)", "value": "dfa7b0b4d24a93e4463921dbc7886e84dfd60495", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629073887, "uuid": "49b1a39a-22a9-4015-98f6-c39aaeeb43ab", "comment": "Malware payload (RedLineStealer)", "value": "5d1a2f8657de5826cbcdbdbc624600c77b985fb9ec43bc3e375591a4aa79fd68196cd86a5a6cf021d0edec4c390ff93c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629073887, "uuid": "5e851233-b24c-4930-81fe-26e5d7f2c237", "value": "T171849D047AE15432E5F2053099FC9A758A39B8301B319AFF63D4863D9F316C19E39F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629073887, "uuid": "bb182fef-e81c-491a-8f2e-ca1ac068ae64", "value": "b535572a0356e55475d8da75f1f57f3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629073887, "uuid": "be1c4848-ab5a-437f-a186-1396136955ba", "value": "6144:LNrji59qUe4LHW60V4Ayscy2sF3Y/VAOYc219/BtJTjjn1LFois8ICCKzche/9Wn:L1U9qUe4LZ0N8VwJn1LFoipIMz/QGbi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629073887, "uuid": "1d6cc211-04b4-48e9-aec0-10a95c25f925", "value": 403688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629073887, "uuid": "a80b6da8-9052-4ef6-b8f5-6150bf4af878", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629073887, "uuid": "a138c969-d40b-48a0-9219-8af6759bd9ba", "value": "8fa76cd75fe02c1093f254977f44ee79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9861b52c-fe70-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629104511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104511, "uuid": "de9d10b7-b217-462a-9bbb-3a68f84d8235", "comment": "Malware payload (Smoke Loader)", "value": "2f9657bc999fcb3242ac51f5eaee18e7", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104511, "uuid": "0aec5219-aa69-4f42-93d7-6222acd98c2a", "comment": "Malware payload (Smoke Loader)", "value": "55841ee53c8625566be9b77526f490765cb5656ba617e54da636b2290753d597", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104511, "uuid": "d0ae645f-fc09-4c5e-be21-8c776aed34be", "comment": "Malware payload (Smoke Loader)", "value": "645ad11b9f0a16dc43ecc1181164540268aaf37d", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104511, "uuid": "5de2787f-038b-48bd-8eeb-844c2b94d57d", "comment": "Malware payload (Smoke Loader)", "value": "a70a8bf6b8bb5b7a274861895efe090109dd3f17268e039c1d77c92dc71f2a4f2bcc3c54bde9ce53fd925647699ca39e", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104511, "uuid": "373a730d-cb21-41f3-b940-c054706156da", "value": "T1B904CE2D758FC4F2E342753444B3CBAC59789F20DA53093B2798266E5F30FB1966638A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104511, "uuid": "1022778a-5cfb-47f8-889e-273083f93fa2", "value": "675f985c31bb43cb925f7664d8fe06b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104511, "uuid": "fa842276-1e49-4319-8a6f-1cc4d2ca6ad5", "value": "3072:yW0LJHWDX7njCOthPjRiNu5evSSd7uBNgeRCc/ml9vtZ7yz:oLirjCOn9euMhd7CQc/mf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104511, "uuid": "770bdec4-e1fd-4d81-af84-719e0dc4b246", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104511, "uuid": "2953f3f5-412e-4463-9396-37174788856c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104511, "uuid": "18e22e2f-c628-4a56-9c5c-d644c95de324", "value": "2f9657bc999fcb3242ac51f5eaee18e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9c7743-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629132596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132596, "uuid": "f891354f-2397-4161-bec7-8a057720089c", "comment": "Malware payload (njrat)", "value": "d19e456d7a0e9d846c9406351bf9cd2b", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132596, "uuid": "95dee06c-282c-49a1-bd62-bfc3e7030f81", "comment": "Malware payload (njrat)", "value": "5632ebec2cc8d5de0fd25bae3e4e2c50e60046d2998e393fedadd2c72e58ea6c", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132596, "uuid": "8b57e3da-487b-4342-b327-510b0558f97c", "comment": "Malware payload (njrat)", "value": "bbf7011f5b88464406b82992cd91be4b69886232", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132596, "uuid": "0bce0aa3-7aa6-46bc-b28b-0ea06d9e0316", "comment": "Malware payload (njrat)", "value": "3bb43da7114cf5e09f339632f9695ca93d8f47945e2d9ef6caa025d7ac118eb42193f6618891e6c7a6a2b9f9f0ae9214", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132596, "uuid": "3a523955-a5d1-4d85-95c1-b994f1b66041", "value": "T1D4317E08703719D3EA06D42231A731DDBD312748AABB8B71145EEA42AA409BF5C5CAB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132596, "uuid": "67af8b54-6c12-43de-9e3c-7aa25259835f", "value": "24:rEEPdqnWahNe/JPpUI0I2rWGItUIZOIIIPITI3uFIJwIEIfILdgcjacdgcquU2bD:3+Mhx2Ahn1wE+FIzhg3Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132596, "uuid": "962643b2-5fbe-4e11-836e-3bcc518f9a74", "value": 1600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132596, "uuid": "15890619-234f-4869-8cba-5ba0843026fd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132596, "uuid": "f12fc231-2d8c-4547-aafc-ae4fa4dcbc41", "value": "Y16530-Payment-Inv0ice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b36cc72-fee4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629154149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154149, "uuid": "cd93f736-27f3-4037-877a-e2e08eb5eb8b", "comment": "Malware payload (Dridex)", "value": "fd7075efa74442ec550ba1b0613f0db3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154149, "uuid": "970fe5da-9e69-456b-ab7b-a28d35781152", "comment": "Malware payload (Dridex)", "value": "56c2a6cd514956d83ac3d9f810ca1d942ba929f29a9af1d37aee3a1ce54a0283", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154149, "uuid": "2ea5a217-aa01-4150-8f2f-c7e79100bee1", "comment": "Malware payload (Dridex)", "value": "cc34b9d08b301523a1ee0f1cce90fd3a9f9c4c6b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154149, "uuid": "22fdd71a-4e88-4bde-b691-f646b0d6e454", "comment": "Malware payload (Dridex)", "value": "18804c24b8363933d20ddc381233f92ae4c45ed63e495a4496030c822c4dcbe07b9be16b81e4c753047296f3cb3a6975", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154149, "uuid": "68eda4a4-a30e-4e05-9ec4-207c64c25482", "value": "T10A44F119659BE45CEE4F7D3D9CDF0A70AB88DDAA0A50397F22F1A14CEBE03E15C24095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154149, "uuid": "e0467761-db8a-46d2-aaa5-9bf0e360397b", "value": "6144:SWtZbAPPimNA/kjoitk17d3/zIZgddQIMgB0ViWir2Yv6ZtK2BnBkxXpsw:3tZbAPDNAcM5d3bFLKW0ir2YvoU2BnBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629154149, "uuid": "852bc6d1-5448-44b9-b892-afea1ec944a6", "value": 258674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629154149, "uuid": "bc95bc95-a7a4-42af-974f-220b120b1bcb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154149, "uuid": "16c66279-2f9b-4351-b33d-9e435a72274d", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_142644520.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e849c027-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629114523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114523, "uuid": "5423c3e6-49c9-40c1-bc69-a8a7e8757854", "comment": "Malware payload (DanaBot)", "value": "1394542595cc3afdd902b92b366858ef", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114523, "uuid": "c7d5e2d7-5463-4f9c-8595-f8bff5f4b10f", "comment": "Malware payload (DanaBot)", "value": "57cf3dd6af6d1b8e03c82a3d7eb2b1a94908015e03ae38d9c9f1f6090d1c012b", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114523, "uuid": "8c574e36-34bc-4d52-96ab-34d01ee84f4e", "comment": "Malware payload (DanaBot)", "value": "a81e431a36944dee3910de34168656475231d39f", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114523, "uuid": "96dc9608-501d-4464-b92a-332c0192e6ab", "comment": "Malware payload (DanaBot)", "value": "1cd27447edd6568ccf86e65c9a3123fc0c31c350976b5a8972dd8e0436f28f58df6155be380fd1f000a961120c13f168", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114523, "uuid": "390810e4-0c37-4945-b7bf-b7c5e820504f", "value": "T1A735231D68CFC536C7D6347400739AAD0EB69F91EABB447713C93E392AB08F251D6286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114523, "uuid": "7bc834af-5501-4021-9363-2393aef07fd7", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114523, "uuid": "652ce0e7-d64a-4971-a64b-bb8b0e7ff080", "value": "24576:Z8Z7t+w4sdXQbNliG7umLW7pLgD/uBgaH:4+wCb/tGaE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114523, "uuid": "6e21717e-11e7-4414-8d5a-c598a8b9f1f3", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114523, "uuid": "a9a0f799-b014-4e72-b44f-0ef7e058704d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114523, "uuid": "a84ed4b9-08ac-443e-bdc7-e28c1f592871", "value": "1394542595cc3afdd902b92b366858ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeac896b-fec2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629139874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139874, "uuid": "280d2250-6d7e-4baf-b7b0-ab33bd394ac4", "comment": "Malware payload (RedLineStealer)", "value": "54cecee0868e914e207f565c5076917e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139874, "uuid": "40ed70c5-4ae9-4625-b9b8-b3a351fc2a5c", "comment": "Malware payload (RedLineStealer)", "value": "57e38cc351f85af87c03a147e900f3c87b3da52e1d223605de5437453917c2e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139874, "uuid": "f355768e-bce2-4f63-8ea7-1ff5f90ba15b", "comment": "Malware payload (RedLineStealer)", "value": "88e481a9db5ca7e8dcef65087e2a571e0bc57620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139874, "uuid": "630b3afc-901a-451b-bf3c-d6ca98a58477", "comment": "Malware payload (RedLineStealer)", "value": "5e188d07b477da50b10b64f0afd21cbd7e775982ae994ef9b63e9b863fb0b9d1af5573bb14d41722339f87ec381a6724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139874, "uuid": "76aaf2ca-7128-4be3-8346-895b4ac3ddf7", "value": "T125645A8517DCFD13D26E1A71E0A166A28931CC75E4C7EF167BCAA0B1184771CBAC83E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139874, "uuid": "c9b5ecce-7338-4885-8171-b80155d80bf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139874, "uuid": "b6c95338-462d-4fc8-91f0-a98ffdb85009", "value": "6144:8wg2rVMFxY2y5HwsA+bTRfLdWpfwMKQWZzU:BriTY2/6TRfQ1wMKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629139874, "uuid": "466900af-3697-43a7-bc5f-8fa7a239e0ba", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629139874, "uuid": "5d7f9ca2-53f2-4c69-b5c4-2959ee2e8e24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139874, "uuid": "8e1d4dcb-3bb1-450c-a4b6-372e64748af8", "value": "54cecee0868e914e207f565c5076917e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d541dd-fe75-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629106709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629106709, "uuid": "f4648be7-b733-4a71-8914-6b3f2c084c7c", "comment": "Malware payload (Formbook)", "value": "3a77a27df8d701a07b76d63091465c11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629106709, "uuid": "128b78bb-c8e0-4cdd-ad69-820983dd1c3e", "comment": "Malware payload (Formbook)", "value": "5ab04b5ba9a19d2a4dfc092111c6df39710e8ee7f0f731243dfb4bd8e1728853", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629106709, "uuid": "40f8b50a-e362-4396-89d0-b94e77192ee4", "comment": "Malware payload (Formbook)", "value": "e833caa3e41bc1817a43a65e155651e1abcd9bce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629106709, "uuid": "9dd333a2-3b18-4fec-8044-a212d7c99b7f", "comment": "Malware payload (Formbook)", "value": "5a4cc3211476a1599e0da3bfb096e583eb0bc87700ec841cd04c146eec1b8438fdfa64a367b2ecf5569e817adfdcaa72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629106709, "uuid": "e9684a83-b35b-41e6-8155-1eaa9e9c4fd8", "value": "T1F895BE40B3B59720E97A43F05863D560C7F67D2AB8ABD30E5CC5BACF6A75B010653A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629106709, "uuid": "b26b3fbe-986c-4c3d-b205-fd363d2f65e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629106709, "uuid": "95b5eb59-5bb3-427b-8a22-066331a5be7e", "value": "49152:NsvQNQNQEQJQEQJQNQpQEQJQNQNQEQyQ1QXaxj5nuEjiKTO2QNQ9v:KccnWnWcsnWccnFiGuFuEjiK/cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629106709, "uuid": "837530a7-0855-4722-8f39-c22ce874e407", "value": 2003456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629106709, "uuid": "c4f1c84c-4e52-434a-9808-300a098157fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629106709, "uuid": "c9b375db-f7c7-49e3-b6b8-5eddb50b066d", "value": "3a77a27df8d701a07b76d63091465c11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d44b4b-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629133984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133984, "uuid": "8324f424-5c58-433a-a154-23fab6b52d3b", "comment": "Malware payload (NanoCore)", "value": "e6934ae61e157b33dfdf48cae80d6aac", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133984, "uuid": "80c40c6d-21b9-4e9c-a8fc-5733d2439bbd", "comment": "Malware payload (NanoCore)", "value": "5ba102daec6e518cfd8b3b35c2bce3e2923b2d524c42a3d8cba2f9dc90bc4328", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133984, "uuid": "5fce91c7-51f8-4888-bba5-2dae9d82cd29", "comment": "Malware payload (NanoCore)", "value": "6500c02108020513d50b1d0591d63aa010ae5c7c", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133984, "uuid": "4dd48d7e-3f35-48ed-9c2f-52c5bda584eb", "comment": "Malware payload (NanoCore)", "value": "6290af0d462d7d67e9d88b9130a6258547aebe1f482fd2c8457fd0ef1e3c71cacb7654a9a95ff660b83d4a4270f760dc", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133984, "uuid": "730a2028-3098-4615-a98b-0f669de8fc50", "value": "T12F317E0870331993EA06D42231A731DDBD312748AABB8B71145EEA42AA419BF5C5CAB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133984, "uuid": "0c8baf08-9285-4c72-abad-cddaf9f65eff", "value": "24:rEEPdqnWahN+JPpUI0I2rWGItUIZOIIIPITI3uFIJwIEIfILdgcjacdgcquU2b7v:3+Ox2Ahn1wE+FIzhg3Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133984, "uuid": "0e2549b1-10b2-454c-826f-8e3bf6016220", "value": 1600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133984, "uuid": "add9dc1f-e75c-4a0a-abc8-94ccd351f925", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133984, "uuid": "67e972c1-1412-4fa6-bf5f-5ab975505782", "value": "Y16531-Payment-Inv0ice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ef2468-feb9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629135692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135692, "uuid": "d0e30a6d-af3f-4f04-85eb-2c841eeae85f", "comment": "Malware payload", "value": "8396573aa3039b144f584107f785b321", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135692, "uuid": "bc3e9a27-558d-4b70-9c3f-2568817b86ad", "comment": "Malware payload", "value": "5bd40d41fd5ace461e2eca366a13b63de2c75f2985be39de90f27fdbc6227d25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135692, "uuid": "aee05cd9-0e3f-4741-bd7b-6b8f3f83b5e2", "comment": "Malware payload", "value": "bbcb5e9779a121d4490ab52e522a37e152b5c5e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135692, "uuid": "367efe33-4a46-4126-83d6-fa8e03cd56dd", "comment": "Malware payload", "value": "a084b739d5a21da632d2e32d2875b8faeee40a7e50f1da0b19e52ae6a1b25accb894e1f35175916a0bab0fa687dd2ce5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135692, "uuid": "18835ecc-a30a-4d75-8876-ae94adaeacb2", "value": "T1FCC4F6E997E357D7F8311A36CB91523450327ED9A0E45DF64ACCB62C89302DED21AD2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135692, "uuid": "371cb2be-f2ad-4a05-bcea-f9453965bd6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135692, "uuid": "94ab660b-8fd4-4e0f-8b47-eae5821e9400", "value": "6144:92UsH9bygF8j57Ptttb+j2S8BU97My+sJhgRNMeryCVdKrL6dP:92s7jFHtHsAHsJivMeryCi/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629135692, "uuid": "8cdd3951-9e8f-41ff-beb6-5abb9c44edbd", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629135692, "uuid": "f01930c7-84fc-4acb-8b6a-4653a3b2e2cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135692, "uuid": "7b30a9fc-bcbb-425b-9b4b-4da8a18b81fd", "value": "8396573aa3039b144f584107f785b321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a04ddcd-fedd-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629151275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151275, "uuid": "d4a6bb9a-2faf-4a71-b6b3-41b9759232b5", "comment": "Malware payload", "value": "fc610878793ee9ee26ed44da1549f4f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151275, "uuid": "f6082ff9-aef4-4d02-9a94-dff9f0f9ffc1", "comment": "Malware payload", "value": "5c8d039da52a39b80531b80b28e53060c2bfefb747ef5477d100bb3c819c089b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151275, "uuid": "07c410cc-4fe5-49ec-81a7-a358baf8de39", "comment": "Malware payload", "value": "118b1e549ede5ef330a439a0c6ff0c0ffe043f69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151275, "uuid": "ebacc437-ff85-4eea-91f8-f39184527fe8", "comment": "Malware payload", "value": "9f4818480e6548c66621ecd5d3b0a4f75ab63a2a1de9d3e3649327071a7a2ba2df67b9c1a33bf36af617663d03a96b96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151275, "uuid": "b717a3bf-4287-438e-aead-81d940d47c58", "value": "T15045B53A15B83B27E079E369E6E44407B3E0945FB625ED59BCDA07A70206F4265C333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151275, "uuid": "77687526-ef4a-40df-96fc-5e435982b383", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151275, "uuid": "a11ecd36-374c-4baa-a010-6802377d7c90", "value": "24576:UwXF5LWoQyFY3blhB26grF6QaXMkYKzyA/JT:7XdyL126grF6Qa8gzyiJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629151275, "uuid": "448458a5-3a1f-49cf-aea0-3009927e77c8", "value": 1166848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629151275, "uuid": "957afb2f-0c42-4145-bb2f-d9a0d35471ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151275, "uuid": "749c8a47-c411-4cd4-b78f-8d62448b3850", "value": "fc610878793ee9ee26ed44da1549f4f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33caa272-fe5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629095322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095322, "uuid": "22a73723-7a82-4ab4-b1f3-9f2ec415daa5", "comment": "Malware payload", "value": "4bae4c3f398e818f4874d249cc8a6a65", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095322, "uuid": "40416ba3-8e34-452d-b3d8-a3233dbc551b", "comment": "Malware payload", "value": "5ccb31ec6aaf7cbfd7b8b4d5817e11e616e99e3d21e376b510ea0afce19f518d", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095322, "uuid": "90e608dd-8c0f-4d9b-bd68-2d1fc271ec50", "comment": "Malware payload", "value": "1b349a3159fbe94514f75af44b04ff624e60bfa2", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095322, "uuid": "394df727-91a9-4747-8833-67dd1cd7c1c4", "comment": "Malware payload", "value": "a399ddad57ea9e7d117a69342fee1745c4fd222dab9c88238064d4c3ce7aa8b7747a8fd524469127fc4a3321205554e7", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095322, "uuid": "85c9e8ea-9945-4e80-8bb1-708b653d9d45", "value": "T151E3120A88D2D47EFA8FDC97DD88DB403D1E8AF7D54071FD28528A72DEB226A3575021", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095322, "uuid": "37827c63-369c-4732-baff-6be77cb7b846", "value": "3072:j3XnPrUudo/6v8HQkDwbzLgKQV0qUN+w3gF3MhJEMEoZn+0K:PI/6BzLvQV0hUE3EKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095322, "uuid": "0caf3ed8-9469-4f69-abd2-e2a4bec2cd13", "value": 146852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095322, "uuid": "9590e2d9-17f8-4c85-a8ff-b55999b665c4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095322, "uuid": "43b2001a-4c8d-4559-a315-b3fda74a9f95", "value": "ORDER PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab68d91-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629114500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114500, "uuid": "b1dd27ce-2acb-4ea6-a91b-9d5cd7c3f031", "comment": "Malware payload (Loki)", "value": "6510b6ed112b21dd535756353bc984a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114500, "uuid": "1edfa466-ce9c-4fa5-8524-0a108cf2330f", "comment": "Malware payload (Loki)", "value": "5e03bf9c09f0749be7a3fca5132570dc61382d1f40d3d39db534e2d5c0d4f8a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114500, "uuid": "06cc25a9-75c8-42fc-84b7-cbcb3dd9ca83", "comment": "Malware payload (Loki)", "value": "925ee5f4ec15db47898f010ffa9db5d822a379b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114500, "uuid": "80b5f0cb-2eaf-43ee-acf2-9db21b17b9f4", "comment": "Malware payload (Loki)", "value": "933166315b16308d6accbd951455a980b332527617f0f1e413fcc753c70904755116520b15610b793902307ee4664662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114500, "uuid": "5d2ae174-6de0-41ac-9f11-78ad9b27c401", "value": "T1C025A13D2AF92727C1B6C375CBE59827F04498AF3815BDA698D757660302A8735C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114500, "uuid": "d59b932f-2a79-454b-b16c-3685645b8f68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114500, "uuid": "84b1c12d-94e6-4d6b-99e5-6d671e075e29", "value": "12288:rYRAxquXdV+N89SbGarISrbfSv4nwGRZZA4IaWmEO15d1NhE:dquyFcWLvbxVpPfPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114500, "uuid": "6fe3658a-57e3-4a7d-805c-4b62b009912a", "value": 1031680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114500, "uuid": "84d532a0-3879-4126-a1a6-c9fe9010b1a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114500, "uuid": "166b59f2-026c-4173-b984-b3e85f1be29d", "value": "6510b6ed112b21dd535756353bc984a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e246b28-fea6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629127579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127579, "uuid": "bf3c4729-3144-4606-be62-5627d6364e28", "comment": "Malware payload (RaccoonStealer)", "value": "575f6a65c28682f88fa808ba8e862d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127579, "uuid": "1ee481bd-1ab3-4992-a094-306c8ab83f0d", "comment": "Malware payload (RaccoonStealer)", "value": "5e08ef6445c40ba0c1216c04291b0d9ef48f0983a9aebd25f214e6fc988daa53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127579, "uuid": "59795195-c24b-4d7c-9010-ecbf30d6817b", "comment": "Malware payload (RaccoonStealer)", "value": "225b7a4d0d657a93b9074d7df6aa6b1b7c3e225e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127579, "uuid": "73bb32f4-5a6d-49c8-97a9-bc12026ca8af", "comment": "Malware payload (RaccoonStealer)", "value": "ab044eca4c0c6e59b21a6f240138e573a23b480f73e2122a420e9e9afd471049307bf013a06cf85c7b9a02f1fb83971f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127579, "uuid": "1f12e66a-a410-4b0a-a858-b68b09531ec4", "value": "T18375120B7B26052BF08948B41A7469FA0BBD8C37B1926D4FE754ED5804F1ACBB9C1277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127579, "uuid": "ef5b04ac-7526-429d-b146-f13b770e13f7", "value": "fb0fb8edc31fffe9bb05edbac608d5c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127579, "uuid": "5aef8fb1-4fb1-4821-901f-5a1c731f05d0", "value": "24576:F13JKz0ildRWDDD/I1bH1tORRC+ixrw3ORR1+h5LORRY+X1S:F15KzmD+T1toC+ixrw3o1+h5LoY+X1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629127579, "uuid": "0ba1403d-8e89-4587-ae74-eccd6b3847ea", "value": 1593344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629127579, "uuid": "39b7a864-9593-439a-996d-d2bde35d6786", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127579, "uuid": "90d9d921-dc14-4ee9-bbe5-69c2061d94de", "value": "575f6a65c28682f88fa808ba8e862d7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e46284d-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629125942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125942, "uuid": "b60d508d-ad46-4387-bba6-28e97b617c72", "comment": "Malware payload (Formbook)", "value": "cfe3224e92794092d3e56685336d8f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125942, "uuid": "ea99883e-5b4c-4c29-8d86-b8b0d9e474b7", "comment": "Malware payload (Formbook)", "value": "5e5f76b60e8eb895e5af44be8ce40f88b77a44840851f761e6818da652ae5cac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125942, "uuid": "2becd186-eccc-49ab-9ffd-e528c1564295", "comment": "Malware payload (Formbook)", "value": "b2a19f920c61caf9af5a65fd02620685661d0e37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125942, "uuid": "853a1dc6-5659-401a-9d0e-2b2ba3039292", "comment": "Malware payload (Formbook)", "value": "21065ddcb4dec15aa1fc22159d5eb6964ba6d29bd5454b48a5ab00a371112c509c19461dcd835dcdebbf46080da934c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125942, "uuid": "7bb3497a-9c7e-46e4-a654-0ad953777ee2", "value": "T162648D82B1454899FE2633B5982B8D3511536EFA643BD71E12DB7B725FF328200A3E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125942, "uuid": "60e5ed25-90f9-4d4c-a5e8-af2f863919b2", "value": "dc195339b27b4fd5a57110edcd4091c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125942, "uuid": "4bed878f-196f-4431-aa3f-7b29c54df607", "value": "6144:P5scKOBajX/f3iRsBlL/s86Br8/GNLuqcVMuRrMzxp0DtWV:PJKQwyRsBN//GFcWz70RU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125942, "uuid": "34fa234e-6695-49e7-99d1-1052e7d60331", "value": 311386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125942, "uuid": "fd6d5c00-720e-4cea-91e6-8afded1ed737", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125942, "uuid": "b103cb88-7b05-4492-aa91-0b00dc2c3d37", "value": "Order_2084.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6edbbea-fe84-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629113152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113152, "uuid": "89ba9ca2-f0c2-4a9e-a1f4-2eb8ab9851d7", "comment": "Malware payload (SnakeKeylogger)", "value": "a7eec6b164e4e44d9f7769e64be7a16c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113152, "uuid": "42e187bc-ce37-40f9-a6b5-9fa47646a97c", "comment": "Malware payload (SnakeKeylogger)", "value": "5eb28e7ba818a6714980d72988364e1a5b7a9108478d1f1121c772419b77a6ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113152, "uuid": "909b0bf5-22bb-4439-b3e5-a894e4e54ae0", "comment": "Malware payload (SnakeKeylogger)", "value": "fd616629535d4b7d6c2302f88e63254b350cd7be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113152, "uuid": "385a6846-84b9-45bd-8b5e-21c2384ac9ba", "comment": "Malware payload (SnakeKeylogger)", "value": "551c26675f46e531da9ba3b50806c2b3a7b95229652b0629f2939ae47f015782148fa8a6e3d2fac3783d6b97cd65dc46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113152, "uuid": "27a80ec2-5388-4fe1-b416-2a19a9519e7a", "value": "T13635D63916B82B27E079E365E6E44407B3E0A45FB225ED59BCDA03E74206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113152, "uuid": "f3929957-f357-47a0-8cbe-f7acbc618dd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113152, "uuid": "73d08e2c-7363-4100-8236-e9bebb04e403", "value": "12288:q4kIcbLDyPFYJDc9F3nC0Py3gAhfIIalhB+zlB7ld0TRQG09X/q+PY7w6f25AbCY:q/bLGPFYsblhBe7Ls+XC+ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629113152, "uuid": "842b1edb-065d-4358-963e-f01cbb78e69a", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629113152, "uuid": "ad4302ee-c7f6-4283-acd8-a396c151ffd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113152, "uuid": "798fe606-23d7-480b-8561-b8b4b735020a", "value": "Purchase order 4500640396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4dd8a15-fe8b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629116209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116209, "uuid": "c750940d-7891-476d-90ea-b1f6d5125230", "comment": "Malware payload (Smoke Loader)", "value": "c5cdf4c9d78205655a2592a499b92e8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116209, "uuid": "a888a06e-fe3a-4e5d-b1da-c9c3fbb41f6a", "comment": "Malware payload (Smoke Loader)", "value": "5ec0c20ecf87a05f81cbf45da37943f2f2ebfead783364ff89dd843a2fcde08b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116209, "uuid": "9706a955-ad61-487c-b5c9-b6be4ca9c8a0", "comment": "Malware payload (Smoke Loader)", "value": "53d9dc7d0394eafd61c8498a01d9d7abd4f3761c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116209, "uuid": "d4b43802-80af-4012-aa73-4faf34c30342", "comment": "Malware payload (Smoke Loader)", "value": "390cb9422fd9a3119126d834eb18e228cf6f2f94bba487a189eea23985217c65fc34fcd43eb67e5c99ddacff80fa2e1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116209, "uuid": "7454213d-1cad-4b0b-a136-fa25acbe9e21", "value": "T17F14CF217990E672C79D017C4861FAE49A69B870EA54053F27982A7F5F70FF0523B38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116209, "uuid": "a13ec690-2e58-4d41-bf49-a712220b883b", "value": "1a43dad8615b89dc6e5d071c17cc8026", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116209, "uuid": "17300fc6-fc04-42b3-9747-8e9760775662", "value": "3072:blDLCW+ruTASBaJvBNBjRGQuKT0yB3iWbme:tLEAAAo7lqqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629116209, "uuid": "279dcd6f-9be1-415b-bee9-4e28eed5310c", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629116209, "uuid": "d1f0ff8c-a8a8-48cb-b6ee-5e213a513432", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116209, "uuid": "82addb98-268c-4245-9c1a-d5e3cb959e57", "value": "c5cdf4c9d78205655a2592a499b92e8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a52407-feca-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629143191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143191, "uuid": "df66e466-b108-47fa-bf10-a7aaac0124de", "comment": "Malware payload", "value": "36c8331e327d1f77fc9e1f23b038e656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143191, "uuid": "4b5d41f3-3d78-42f4-9539-fff194bb29b0", "comment": "Malware payload", "value": "5ffbe2b24599383732373e34a80cd2cf864d806595d80dfc1e1ae3af83065780", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143191, "uuid": "126b0121-e25d-40ff-9349-056611d7027f", "comment": "Malware payload", "value": "98d95c77d51e85a539428dcb985cad0ed9b1ef6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143191, "uuid": "1d4120e3-75cc-438a-8bb7-d021665cb3da", "comment": "Malware payload", "value": "becacf6addef96f05f9a5b80b4715e2bd80c9bb4b44a6dd61a3754c2af4e1c523ddff266a7829e3394488381787eeee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143191, "uuid": "74257943-7846-476e-ba96-bc74814a1758", "value": "T1DF25493439FA501AB173FFA98BE474DADA6FBA733B06645E106103864723A42DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143191, "uuid": "6d6b5c52-92ed-4cb2-a687-4ab64bf3162e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143191, "uuid": "25bdfbcf-ed1b-4525-8d33-2dac13662650", "value": "12288:DJQuwgd2GKOO6kiMAHJY0G+CVUaOsp5g18E/1Bh1GW1gnHiID43m55tM1hJj8oHm:D0AmEIqc8YALW/0HA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629143191, "uuid": "3b7f66c5-4aa1-445c-9944-cd91434f434b", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629143191, "uuid": "812f1508-609b-4077-94b4-a1213a0be5cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143191, "uuid": "e3d87746-5f1d-4c2b-9f40-77056dbc0554", "value": "Order# 210145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e27add-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629114331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114331, "uuid": "3cb688e0-2737-408d-840d-7e0414ec957c", "comment": "Malware payload (AsyncRAT)", "value": "2c26c911ac8cf780b55cada3e0f72ada", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114331, "uuid": "26141b2a-2553-4233-b02f-5aabadc150b4", "comment": "Malware payload (AsyncRAT)", "value": "6034df19af145c0f4c222c8ca73ecf6ea81d0be52fee85fa6def13beb5f2608a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114331, "uuid": "cf59cbfa-8847-4817-9c9b-a4ebfb1e51ae", "comment": "Malware payload (AsyncRAT)", "value": "0e0d202f496a388640642e6ba89b6ba37f9ad2d4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114331, "uuid": "49e1ba75-3260-422c-bff3-841bbf00ec80", "comment": "Malware payload (AsyncRAT)", "value": "fdf24973dd665e8faa93fb6a5cc1088e2bf6458761c12bdd493873351f2dd6c7f9318eda0f3c04605be218aa1b4459e3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114331, "uuid": "f92c2d8b-0f60-4b83-967e-61c509a3fb1c", "value": "T11C35B63A15B82B27E079D369E6E44417B3E0995FB225ED59BCDE03A70206F4265C333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114331, "uuid": "29e51d7e-52e0-425a-b699-34363662a40e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114331, "uuid": "65f4338b-54eb-4e84-9389-bbf5996d2da7", "value": "24576:abwpFYNblhBaygWy1m+/IakqBMDxuUnNC4J:fy91avWyBIqW88Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114331, "uuid": "f5f9602c-6a44-441a-b353-b8cd7280e7ee", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114331, "uuid": "b2ce15a0-9a13-42a6-99da-d55fe226615d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114331, "uuid": "350eb6a4-aee2-4800-8d45-78a8a9688042", "value": "CV of Masuduzzaman.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f85e070-fee9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629156465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156465, "uuid": "a2fa8131-246d-4ceb-8614-668d855f2e96", "comment": "Malware payload (Dridex)", "value": "2a256d0f32b7d113349b757283541b1d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156465, "uuid": "74e5d0c1-d08f-4767-8727-2c237c33fa1e", "comment": "Malware payload (Dridex)", "value": "6047c8ef2711a830ec57104b44a708286742c4f14ed531253a4d8b61ad9445b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156465, "uuid": "73ec9ddb-546e-48a0-aee5-843cb6542c44", "comment": "Malware payload (Dridex)", "value": "4704842bd4e58825b1d7e7b853c236e9172a3913", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156465, "uuid": "17079e39-b759-4fc0-adaa-cc93259ea2f5", "comment": "Malware payload (Dridex)", "value": "0f6d13a1f7687bac9bc15d8854bc2a3d89fb467261edd4cf2509df1d0e0f25c4b49a408220cc003656e935b36ded737f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156465, "uuid": "5e929cb9-4801-4f34-bd3d-8b348cf5730d", "value": "T13C240237CA9D8813C49DD3BAAE3215E1536603464705FADEA1B36E792E109F71BD242C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156465, "uuid": "e6dbd7fe-e5bc-4f56-8a3d-03d7542b7c54", "value": "6144:uogkLjLhWAE4cD4VFOkDIKJwD1U5g9QkS8:/DLZjc4s+IKo1ydkS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629156465, "uuid": "4b1b156f-3f2c-499f-9576-b41123484c1f", "value": 223117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629156465, "uuid": "0a4d9052-ae88-45fa-8441-9055b78fd91c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156465, "uuid": "673e21b3-89e8-4352-9d55-6ce9f8b10f9c", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.49642139.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b76305f-fec0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629138714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138714, "uuid": "6866a33b-5235-4742-8e64-d55f88965c16", "comment": "Malware payload (Formbook)", "value": "8bc14b6636651dfa116e292bb7915194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138714, "uuid": "acd14697-8bb2-48f4-b318-1ae3122261e1", "comment": "Malware payload (Formbook)", "value": "6134f857a84f2686c84d2d2273be977eafa19b97acdc16532e4b206d62f51e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138714, "uuid": "7163cae1-baee-45ba-954d-1662e8ac3c3c", "comment": "Malware payload (Formbook)", "value": "052ec0fd9a1bf7a07880b789699ac2b067b80f55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138714, "uuid": "faeb2016-9e3f-4032-98b8-23e5b0aeac2f", "comment": "Malware payload (Formbook)", "value": "8b3eaac9b469cf8012a7480cd262be7e271ad710a4e4c2dcab660e183b550d2e4a94954856c3f0a37dd298ef22d2fd3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138714, "uuid": "ee55830a-fbdc-477f-873b-21538c6f2138", "value": "T1AC45C83915B42B17D079D335A6E4C41BB3E0DC5BB26DED5AB8DA83A70206F4265C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138714, "uuid": "9c7c0022-de3e-4fa4-aed6-ea60dd025ece", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138714, "uuid": "d98299df-8cec-4d67-9512-5b2322b81358", "value": "24576:VM5Fh7VFYZblhBWI6H4fmoZddLxZU/L/fm:W5PhyR1WIE4eofdLxZU/LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629138714, "uuid": "e3376666-ed6c-4039-94ed-b9443c0c55a2", "value": 1263616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629138714, "uuid": "2e598cfb-24aa-4a98-8a5a-ce787b551350", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138714, "uuid": "ce298095-69e5-47e9-9165-7342301cb730", "value": "Wire Draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c67f71-fea8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629128509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128509, "uuid": "185d8744-645c-4281-b4b2-ee88cf97df16", "comment": "Malware payload (RedLineStealer)", "value": "5da99c33c90f7b6287ec759af919beaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128509, "uuid": "9706b34a-afc7-451a-b841-01aa3854df78", "comment": "Malware payload (RedLineStealer)", "value": "637a0494e576015bdbc53a9a3d5efd6ed2cac129facef169a06ed4f2d07188d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128509, "uuid": "c2dc18af-1d92-437f-8688-1ddf9eaa89e5", "comment": "Malware payload (RedLineStealer)", "value": "41da1c98a57bc043d119a590d9a6577915d1d03b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128509, "uuid": "ab5ca6ab-c968-4d87-ba30-908433bc1cca", "comment": "Malware payload (RedLineStealer)", "value": "31d48dcc1346fa71825af02589e2516e9bf7c0a582b54d61e0a219c9c4fa8a137621d4e18bb6e2cb04b687c079e957db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128509, "uuid": "62aaa282-16d1-40ac-8151-5087a1e97702", "value": "T1705401027890E9B2C4C2057634B2FBE15ABABC61DA54425B27497E5F5F323EC532A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128509, "uuid": "3bf8b37c-5cbe-4cf5-b0bf-cccdfbeb12f3", "value": "32eca4427f106c548c06ec4f87d7efd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128509, "uuid": "c48406e2-99b3-4810-8f82-142b7780417e", "value": "6144:qp+bAnv2R5e/uUFSUuySKl2JliYFoylAeAwm:qpCAeR5eGESUu9i4qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629128509, "uuid": "35cad7ba-6285-4f77-bf72-2cdce7370682", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629128509, "uuid": "cc69523b-cc1f-47a9-b924-4cb439399e7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128509, "uuid": "050fbf5b-3b1b-4231-ad76-2cc2eac56219", "value": "5da99c33c90f7b6287ec759af919beaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b77a771-fe5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629095496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095496, "uuid": "a949d4d0-4b49-4210-bbad-3df8ecb6540f", "comment": "Malware payload (Formbook)", "value": "78a48c9ca7cb69737740772bfbff1db7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095496, "uuid": "396a9e84-0e02-45e5-b22a-ebbc9356ba23", "comment": "Malware payload (Formbook)", "value": "64550a0d3d1c28b1ec50006327a707b7287997aa7ca146153440935a033ccb97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095496, "uuid": "a493ec67-a0c5-41e9-9c9b-59661f5e7556", "comment": "Malware payload (Formbook)", "value": "2079cb5fc6559e71f264144c92132a5a4e174962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095496, "uuid": "0879b561-ab2b-4aa4-ba50-c17176861fe5", "comment": "Malware payload (Formbook)", "value": "697197b33797104529117c435e4efa77653f0582515d9dbf87a0af6d9ce7cac56238a6aa619ee548743c40c648620351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095496, "uuid": "2fde6b6d-140d-4b6d-aaee-410acf596fdb", "value": "T137F4CF7171A78A96F51F8AB42538BC5003B131F3E9C69A39171A514ACFEDE983F4824F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095496, "uuid": "ac86d403-d66f-4782-aa66-4bd71256a986", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095496, "uuid": "4bc82a38-fb64-4bb1-951c-1e4b626a3c9c", "value": "12288:2ToRXAGxYR+PMnf2EKXNzo/Yvf3CJDvrHzuaImz1NZ1eCiHUQhnmw2o5f5JOEPpQ:AoRXcRH2XzgYvvCpzXIwLiFnl2IRHPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095496, "uuid": "dff38e05-7bd7-4d3b-835b-7633532a0271", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095496, "uuid": "3abdf2c3-76f2-4d19-8649-9492b9ba8f6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095496, "uuid": "98515b2f-3f26-4b13-a0c5-12baa54989e9", "value": "Quotation 85663455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46108ea3-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629114251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114251, "uuid": "ef4391d7-6b20-4930-937b-d4b6cf3d3970", "comment": "Malware payload (Formbook)", "value": "e0e2f85a7c7542a6aa086a34be3ca86e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114251, "uuid": "61e5fb42-6a0e-4d5c-a08a-4b62351c87be", "comment": "Malware payload (Formbook)", "value": "648a44e30f42dfbb760c84869255b1246b5940450e2fea476b1a138634e1785d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114251, "uuid": "6a141ec6-f2ca-4f79-aa0a-21608f029ab6", "comment": "Malware payload (Formbook)", "value": "f29e3ee8f219c79dd89f5884fc342356f0c47daf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114251, "uuid": "d70cf0ed-aa47-4f66-bb1d-a27ea5bdba98", "comment": "Malware payload (Formbook)", "value": "a7a7899e1170612e388794852f031ac34d03e8e983267be3bf283d9fc8a9a5114d808dfc15a34d5fa86e022618cdad0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114251, "uuid": "aac5ca6c-d93e-48e8-a767-7b4abd03e621", "value": "T13845E73916B82B27E079D365E6E44417B3E0985FB225ED58BCDA43E70246F8265C333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114251, "uuid": "ec070fce-5453-48bf-99d1-12b787c2db78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114251, "uuid": "c641e3d4-8f63-4413-a0f2-b23462247f5b", "value": "12288:YY4aNzsdDXHFYJDc9F3nC0Py3gAhRIIalhBMvAcmTaciU9dYdIR5PsYoYi0fpaNl:YoxKzHFYSblhBOmi3d45k1l0m2hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114251, "uuid": "5e45db62-3c38-4105-809d-48d93646d0c3", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114251, "uuid": "aba56188-2593-4d1b-b651-eb3626aa3912", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114251, "uuid": "58f8c974-aba9-44c6-ac9e-2929eda20789", "value": "SecuriteInfo.com.Trojan.PackedNET.998.2228.4507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdd99ee-fed7-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629148896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148896, "uuid": "351105a2-6993-4584-af12-e62281dac112", "comment": "Malware payload", "value": "15011495873d6ffbc1b1aa1e9bc144ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148896, "uuid": "a2918397-1cdd-47f1-805a-b177f1011bef", "comment": "Malware payload", "value": "654055dd7123d970ab65cf73a94418b81105c73bfb9a591a24be998da4f31373", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148896, "uuid": "fc0a2d6d-e697-4c8f-beca-0f0fd079ce6b", "comment": "Malware payload", "value": "1fb2cc2dc1e3b39d1930ee2bde2dd6e10ec4e7e8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148896, "uuid": "8e46342c-3037-4546-a2c0-cb5e071ad0e5", "comment": "Malware payload", "value": "bb37e5830e818b84bc741098a37cafa40141f8ed0ac72acd6ffbed7f87c588deb4115cee692f5c3196dfc61bb75c5ea8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148896, "uuid": "a2b00c9d-87fc-43dc-8082-47606b58ec43", "value": "T17814D083EBFB72BBD0024CB22729963B6559D846CE58DDD5F592D216C073EC2502BE23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148896, "uuid": "e536f4f0-5500-4dc3-b8d6-227dbd29493f", "value": "86bd8478222b7f02b724c9321381bb0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148896, "uuid": "b09104e7-2a0d-4e94-8db9-ab45f0d38094", "value": "3072:zWa3N1eqJ7cNe58per6JpynepWHVD9qMe402JYIUk9H8Iz83SWN9klSC:FxwO/Spynep6VDcMeQeIUk9cI6V5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629148896, "uuid": "eaf8ce0c-fca7-4d45-9202-2308c04d1fdc", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629148896, "uuid": "dd3dd8ff-6835-400d-b6ef-125132cf69e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148896, "uuid": "aeb88b35-eade-4a98-80dd-84ad9d909c71", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c85bbc6-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629134045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134045, "uuid": "574d7a7c-fd00-420f-b999-313fd9090cc3", "comment": "Malware payload (Dridex)", "value": "13f5790f616d9a889db8726fe74cbfc7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134045, "uuid": "845b4a3d-6c93-4706-8202-8be251ed78bf", "comment": "Malware payload (Dridex)", "value": "667b3d648f835d71a8e1ac233b7507d1fa0ffc742023b9be1bf22b96d3e6cc47", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134045, "uuid": "8768f8a5-9a4a-48a7-9773-ba36a0c05a30", "comment": "Malware payload (Dridex)", "value": "cb0d6b327ee6276c0e90c24785b4b9ea15b11271", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134045, "uuid": "9bd8494e-416e-4523-9d59-e385e2a364e8", "comment": "Malware payload (Dridex)", "value": "97730519d1e1e949b459b61cc58a246e742f43dfc001ae6ff332a4208c18f269b1782d44ed8bd12c1cc642f48c3992f9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134045, "uuid": "1c9ff8ce-8cb8-4857-bf22-2ac3a860747c", "value": "T1354401556813E85CFE8F3D7D8CDE00746FA98DEE16107A7F12B1AA4CEBC02E01D654A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134045, "uuid": "7b2a2e25-0cb4-444a-aee9-bc05f01880f7", "value": "6144:SwtZbAPPimNA/kjoitkl1ruHnFmLNBojYwgIw4EXzuTmR:3tZbAPDNAcMvrUnoBeYwjwdXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134045, "uuid": "d128fa90-7ab8-42b1-bbde-0a49531958ea", "value": 268864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134045, "uuid": "0fed8fe2-e448-4436-802e-325718f3b91d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134045, "uuid": "d52eb162-4681-4bf1-bb3b-c74632f14338", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_3_659764852.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624d3ea0-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629104849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104849, "uuid": "1a2fc94c-230f-47e4-a5ff-7c949abf9e2d", "comment": "Malware payload", "value": "b1001caa0c28f2b2639076e392661d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104849, "uuid": "0e1b8f6b-8196-45b1-8a6e-e78ca1552508", "comment": "Malware payload", "value": "66ef46c9342066d19a489e8118207988beb87ba68f1384a091892ea23b562920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104849, "uuid": "f0ee8df7-4aee-44ed-8841-1a5e1b1fefd9", "comment": "Malware payload", "value": "7ae9183bff84d925352f2832d5df50dd1175f586", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104849, "uuid": "b4b7d710-c77b-4ba6-a8a7-25a5761b98e9", "comment": "Malware payload", "value": "2dbbb89540b9f159f93361245389176d05a3555e0a626ad453f623d83bd21f32dde6c6d50cd4900e60d14925aebd6eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104849, "uuid": "15f6ecd4-7e37-439f-9b69-25361ec432f8", "value": "T1CAA53359C4BCA01FE8BF00723671DA393ED30662D1EC56245593DE1F9C8E911EEBA932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104849, "uuid": "e4ed5653-42a6-4852-b655-eebb80deef76", "value": "49152:Z7cNuGXqqcjPLk+SZYI7iWxqwrYZuNiVrypilYf20iGn7NZ298:Z7cN9DcjjknZPxqDrsuYfHiGz28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104849, "uuid": "24210732-5719-45ac-bbaf-714f55323b98", "value": 2064575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104849, "uuid": "fa90b4eb-a726-4d2d-8c2b-d99db7e9f19a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104849, "uuid": "fbefb1c9-cf7f-4bd8-987e-e5faedfaa14e", "value": "b1001caa0c28f2b2639076e392661d61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c913b6-fee5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629154571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154571, "uuid": "6b3e4a4c-deb8-4772-a709-1ec486cc4d8d", "comment": "Malware payload (Dridex)", "value": "1f870e39fd749b4511d2f718e8fdbce0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154571, "uuid": "ed79872a-7133-4a7d-a840-cedc6457759c", "comment": "Malware payload (Dridex)", "value": "67e444ce5f19e4f55bdb7b6e0f5f1eb301cc7bfdda68a0d81e46a7d00feb0197", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154571, "uuid": "5e913b84-8682-4b04-91ed-aa103248a97a", "comment": "Malware payload (Dridex)", "value": "5ddf570778c14e518b0fef8b0c8d01228db02159", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154571, "uuid": "c4beb39a-c7dd-483d-98e9-188c7e946072", "comment": "Malware payload (Dridex)", "value": "32d452da5f10f71f8e4d949ccb71ceb39c09ba7735a70527af63451260db9cabfa4b146c2c66d329fa009630c1c54a28", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154571, "uuid": "abf56ba8-c99a-437f-88fc-c405e28c2f42", "value": "T1A734F1921983E15CFE8FAC7E9C9E15707F48CDBE1900AD6F21F4A15CEAE03D15C19896", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154571, "uuid": "e56a807c-ab0c-496e-a343-bef9033a77ef", "value": "6144:SxtZbAPPimNA/kjoitkLqpQFgZAsJ31dW9Yb8Hrjnws:ytZbAPDNAcMbqJJfW+Ojnws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629154571, "uuid": "0f575647-267e-43b6-b592-da1dcd28f063", "value": 251761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629154571, "uuid": "9f270165-68cf-4502-b85f-bb2e7e6aef37", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154571, "uuid": "4e69cc22-87d5-4e30-8271-1bb68fc58188", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_7_15690201.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80d9736-feda-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629150144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150144, "uuid": "d73f6652-7162-4f3e-9622-8111e535ee8c", "comment": "Malware payload (Dridex)", "value": "6b1d5d71e8e2ce119012942663baad20", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150144, "uuid": "57f52059-22a0-4e68-bc42-1a9b30dcac13", "comment": "Malware payload (Dridex)", "value": "68804b33d7a20c87144ab8a01365df7bd97e2c04354017a78b40985f190d64fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150144, "uuid": "82883a53-6d33-4a97-9254-5c6b17540dee", "comment": "Malware payload (Dridex)", "value": "8dadf487e03be79b1bc066a114d4fb815e0caa0a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150144, "uuid": "47415b97-59c3-406a-941a-69238f8e545e", "comment": "Malware payload (Dridex)", "value": "505b74b51c006cc61e57a0a8d442ec86587d98faac95f58b9a3c8f93e240ebc6cb5dd5a2c750241a91a23855f9594393", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150144, "uuid": "5d932f98-432c-40ef-b97c-0d19108467f5", "value": "T1F5641206A1B3F289CED5543E0C5E1FC927F59EBB61805A1AF2E5E12EFE04CE7464418E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150144, "uuid": "63a010b6-37c9-4240-9b4a-72028fb74dc9", "value": "6144:SjNSLcq+YXEshbHCQlrY/mIFMB9h8Judr5+srnsJFgziT2tX6:APYXEs1HC8ryJMbUuV8KsbFT2d6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629150144, "uuid": "d716ec9e-2009-49a0-9360-f86fd706d730", "value": 308816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629150144, "uuid": "f824a4a9-9326-4ccb-b1eb-da0ad3785ee0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150144, "uuid": "a3382597-4acf-48ce-a997-71481d1d23df", "value": "taxve_2115514_20210816_340080_68584309.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560bc575-fea6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629127592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127592, "uuid": "0ad95fe4-c1f3-4528-9036-1b8988aa1dc8", "comment": "Malware payload (Loki)", "value": "ad8687e4e2acaf925a0f01332353620a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127592, "uuid": "694198b0-7f88-4fc7-881b-0261d7e72423", "comment": "Malware payload (Loki)", "value": "68f5f3fbae38cb364b9370f90f4c3246dcf48b69aab6c664a7ef1b1196e47041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127592, "uuid": "ef7622dd-fa31-4e91-a534-1d822836ebe6", "comment": "Malware payload (Loki)", "value": "7329cc88359a62fa74035ceb0b5695fcaa0fe121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127592, "uuid": "069a534e-8e07-4ea8-ba1b-40619bae89fc", "comment": "Malware payload (Loki)", "value": "537f9625863c39ac52a2d646d89336057b06af7cda96c3d93f7dc2c688cfe64fd7453aa80543b3b0d39b5364667e7afc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127592, "uuid": "b5031c0f-8f78-4ddc-bdce-43f82ec88bea", "value": "T10EE3063AB2D7C840FC00AC7112198635BE5FBC67625A1E0BB612A70D2AF65F6E4F550F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127592, "uuid": "e20a3a70-1142-403d-bd1c-6ef4567f05ad", "value": "2b4f5fe80df3ed9a6d3159464b73e6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127592, "uuid": "db47fff2-f549-424c-ab45-0455a4c6c572", "value": "1536:n85UEPHGV/HtDePM6RKVbAdG2MvCM0vuVtZEZH531jV71gKyP:EFHGV/Ri6UKCM0vuV2H531HgFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629127592, "uuid": "aaef4ea7-9015-4028-87e5-8f4432ddd337", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629127592, "uuid": "7de9bedc-fd75-49c4-9762-ff1c4008e249", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127592, "uuid": "6349207a-c63e-42df-8b5f-d33283e87e70", "value": "OC7041856392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194b299c-fea6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629127490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127490, "uuid": "ab1b2d97-ed04-4976-9681-d48b0ea74827", "comment": "Malware payload (Loki)", "value": "fad3fed5984b3daed7f897a5d2f594ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127490, "uuid": "916776de-e17c-448e-b7a0-5c04a33b4129", "comment": "Malware payload (Loki)", "value": "6a4cbb79fb98af5d829e1913cac1634afff6a26b9c33b1e87be16ea7cdee7910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127490, "uuid": "76353b41-3de9-4cc9-80c0-f7d6c82f39a0", "comment": "Malware payload (Loki)", "value": "3a5554ebe962783e0cfdab0df735064e8a36f3e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127490, "uuid": "7ffd799f-235f-4b0b-be09-532b49b772ab", "comment": "Malware payload (Loki)", "value": "9e504c20c2791fc6ad8f43e87502864106bb4432215b64a9d6a73039360e3f9408fe0957aef4bcd7994754472aefd091", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127490, "uuid": "563f8518-9392-4917-a251-3fb50dd84abf", "value": "T1E1E4BF7171A78696F11F4A742578BC5403B231F3E9C689390B1A610ACFEEE987F4960F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127490, "uuid": "212ca22d-cc56-4a6e-8ead-6bf532179f61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127490, "uuid": "0fc474bb-908d-47b4-b1b0-f825edff7e19", "value": "12288:TwRB8LDG6bc3EQOws9j2y1264VanhoRVkTlgq5JOEPpBja:Twf8Lrb/QOwFy1GUQVUVHPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629127490, "uuid": "efe8edfa-0616-46ad-8e40-6414a598e97f", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629127490, "uuid": "a7f99769-958e-4afe-9864-a23c4b2742c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127490, "uuid": "36a76f51-b152-4951-b4a3-97d09af07660", "value": "Purchase Order_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282d15b1-fec9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629142548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142548, "uuid": "ccffe97d-df2c-4a28-8ca8-06159e49cb2a", "comment": "Malware payload (Dridex)", "value": "e762c6c475b96d6d8ec59a68c645f7b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142548, "uuid": "a3fea641-f92b-4efc-b18b-4ee8cb9194ee", "comment": "Malware payload (Dridex)", "value": "6b10695629cea83e38abf94a08c0497efb310c1997a57f94c511bb280161d05e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142548, "uuid": "a83cee81-635f-4778-babe-1343c983e90a", "comment": "Malware payload (Dridex)", "value": "d6d342e482b04002b174129cb900ad0cf48ab8e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142548, "uuid": "905cfb0c-4768-4d5e-b104-476dadc54ffb", "comment": "Malware payload (Dridex)", "value": "faddc7662e0d23064b34c19c183867aae993c907afc9e05ef1b2218ccf8ae0ae25b91d4c48b622ede97fa47f1539c9e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142548, "uuid": "a5b45aaa-6a5e-4921-ab09-d58ce70a26cd", "value": "T1504402916963E55CFE4F7D3C9CEE20B46F89DD6E0640A96F20F1650CEAE03E52C650C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142548, "uuid": "f8450b98-9285-4461-8191-1a03b7800d3e", "value": "6144:ShtZbAPPimNA/kjoitkDXjVsPfMjBn54DGHQARLwcVlHynIh:QtZbAPDNAcMTXjVsPfGB5bHQAW2VkIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629142548, "uuid": "203cc907-e46d-448f-9181-7aa91276df3c", "value": 260217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629142548, "uuid": "3d549df1-2d48-4b4b-8cc6-9b19510e72ab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142548, "uuid": "48ba4c05-326b-4263-9615-04149de2918f", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_7_139067.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2d4b39-fec5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629140860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140860, "uuid": "08248e62-70f1-4173-869f-a4ed085b1537", "comment": "Malware payload (Dridex)", "value": "87af72945f598b98651c3d2db52ba213", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140860, "uuid": "e7590789-af8d-4aa8-8546-7ae9aa00ae69", "comment": "Malware payload (Dridex)", "value": "6b596136ea274a9b75997cfd472eafb755ea49c7be3eabb731b3130783d31b74", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140860, "uuid": "799a9870-e692-4cb3-8e24-156e33875c1b", "comment": "Malware payload (Dridex)", "value": "8ca3003c56f56723c4bf380ec7416a2846126af6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140860, "uuid": "177f3955-db65-4392-b16b-73ec051ffdc9", "comment": "Malware payload (Dridex)", "value": "db4fa44b25db9929c2c2c1f590afdb5ea2be7edbc7af399f0c5195cb0d5353fcdaa64fae171fb50fa8c628ab90e62d51", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140860, "uuid": "ad9c6d47-7dc4-4713-b4a0-cad2a980a726", "value": "T11764120E81B6F058EE9B40364DAF0FE717F55F4B12957A1366D1E10EED0ADE363A204A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140860, "uuid": "0a92dd7e-9295-4f17-8991-3df893d92f8b", "value": "6144:ShNSLcq+YXEsensE5LzSyM2TF8diwr8o4Zy++UemJP0vPIoZM0UP:OPYXEsensAJF8IwQo4Zy+TP0v1MN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629140860, "uuid": "8bd41d69-804e-4e03-864a-c4690aca684e", "value": 311301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629140860, "uuid": "b8e4691e-377d-44c5-9055-d9c83dd2c5c7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140860, "uuid": "e864b179-c1e6-4daf-8dd6-01af41633ec2", "value": "taxve_30174291_20210816_1811809275_9866011492.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec86853-fe39-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Tsunami)", "timestamp": 1629080872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629080872, "uuid": "53d22aec-e901-4567-84ad-b35650db344c", "comment": "Malware payload (Tsunami)", "value": "f8b93d3cd09bee869775735089099e4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false }, { "name": "tsunami_backdoor", "colour": "#7106D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629080872, "uuid": "93639a7c-f929-48fc-b18d-841a174fa5f7", "comment": "Malware payload (Tsunami)", "value": "6c6888a75d6a62dc7414dd22d0b6a70456a108a14889b8406f7aeb8b61b34633", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false }, { "name": "tsunami_backdoor", "colour": "#7106D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629080872, "uuid": "381ed121-7a1b-4544-adf7-f6ea605d3a1d", "comment": "Malware payload (Tsunami)", "value": "90f1a3773f01326aed76c9d8bea5054853f538dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false }, { "name": "tsunami_backdoor", "colour": "#7106D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629080872, "uuid": "93f68fe8-8a86-4d96-a96e-71559d7bbf3a", "comment": "Malware payload (Tsunami)", "value": "6d51eaa855b38c5de7cc64ea3032cdd2c55f21103186b0df73d2756340f0be9446b0b188399b5860a6bade62ac5ee315", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false }, { "name": "tsunami_backdoor", "colour": "#7106D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629080872, "uuid": "c4557257-9efe-4443-8248-94af70ef2b5e", "value": "T1DDA31745F950477BC2C227F7F79E479D3B355A64C79733117A2C2EB02B82B992E29210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629080872, "uuid": "6b880605-fd22-4b6d-b9c2-3daea1d973d4", "value": "3072:FMBXyYxtTx+A0yaG/Wrhl2KSJL/1RQOn2fxHoA:FM9ZxtB0DG/Wrhl2hL/1RQOn2fxHoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629080872, "uuid": "cda7e1d9-2c76-4928-b63f-904e976804e8", "value": 107255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629080872, "uuid": "23af1a71-6032-4991-92bc-b8a605979625", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629080872, "uuid": "3d058272-b9c1-4b95-bfde-0870f1536377", "value": "6c6888a75d6a62dc7414dd22d0b6a70456a108a14889b8406f7aeb8b61b34633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3f58bd-febd-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629137588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629137588, "uuid": "f0a0958f-70dd-4756-84f4-963e50e4103e", "comment": "Malware payload", "value": "aca861f898f7f5aa3142c3d6a6d35e9c", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629137588, "uuid": "9477c447-d036-4823-9d2e-27df1d968282", "comment": "Malware payload", "value": "6ce77d81ccf243f29e9a5d8a381e4683827d3a4681d3a8467cb04591ee89474f", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629137588, "uuid": "632bc7ee-3b77-49d7-91ab-7aaa96302291", "comment": "Malware payload", "value": "0c66986721fbd56814158f57b53df55046ab1074", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629137588, "uuid": "868edeeb-864f-40fe-926b-036072d1eb48", "comment": "Malware payload", "value": "2b26e3ea0e0a875ea572d3659c9cac627ec6f2aac600f6f6a614b31dc13d33656aac463db577bb2f5e55c81754015c59", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629137588, "uuid": "5b2086c6-593b-4937-ba85-81daabd0a148", "value": "T13627331EB06607DDEE9D787B256727BCE208A1EBCF624805E1518685CCB03C6E9B0D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629137588, "uuid": "71a4735f-56d7-4fd9-92c7-25d83aff3b1b", "value": "393216:eBYMO4a2OHx4srIZLCEtn0gbagWy0fhbGuQwcumI6/h/NZ:eBYnwORIJCEtn0gbagWy0JbQ555Z/NZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629137588, "uuid": "19107875-c20d-46d9-a11a-40a5edf3515c", "value": 20329851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629137588, "uuid": "de960fe0-d84e-4b35-89c9-399b436753fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629137588, "uuid": "37d807a4-ee41-40dc-8f7e-8a959cb3b814", "value": "newwords.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125d2fbe-fee9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629156255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156255, "uuid": "1afd2d86-4b79-407f-bc51-9fa666f2a7d5", "comment": "Malware payload (Dridex)", "value": "16103f1f626df1b96e109ae784da2433", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156255, "uuid": "42a6f474-2688-421a-80bf-7e4a096131ea", "comment": "Malware payload (Dridex)", "value": "6d8618f80b90e900aed8ea11e9f19dd8dbe59005f1d744bd1315a6493eb52fc7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156255, "uuid": "c037a4f0-985d-4270-8a69-dbf2e789a735", "comment": "Malware payload (Dridex)", "value": "ca0454f33b79d8cd5d910dac613dd3f09fbb6eb7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156255, "uuid": "c2fe69bf-4720-4aaf-9442-cb53fccabf03", "comment": "Malware payload (Dridex)", "value": "da256bf5106dcc100bcdd6c7bc0428db648e0165c00874d463851e6dcc81f78565a051f8a77b5798329c7228cd391414", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156255, "uuid": "64563261-217b-4d55-a866-bf0cc48e29a3", "value": "T14D341267E75CCA43C25CEBFA7E1325B093481603D24AB1D984E32E763D486A14BDE45E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156255, "uuid": "c1d1445f-3efd-492d-9779-b615efa0a8df", "value": "6144:DogkLjLh+E9xQnKIokTGqjq1K5LdcFY3Y76EbXU+7:cDLZ+EEnKICqEKJdcq3Yfbk+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629156255, "uuid": "484d06f7-c754-4f4c-95e3-486cd89bb22f", "value": 236514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629156255, "uuid": "8b1c3c81-d630-464d-84c5-73b4d4856794", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156255, "uuid": "8b59b65a-175e-420c-8b0c-f0aec2a592b5", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.41714.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941b45b1-feea-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629156902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156902, "uuid": "e58b9c8c-a4a0-4bc5-bf60-a88cd2703a01", "comment": "Malware payload (Dridex)", "value": "31768471945e6ca95322da8080a89296", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156902, "uuid": "5b1dfa17-7992-47f0-b04d-197d46e4b5a5", "comment": "Malware payload (Dridex)", "value": "6dbc537d23144b267f2cf60ec2c92aa8a785ed95edecaa9586aa2bbf2628b51a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156902, "uuid": "baa13026-b728-44d5-acc4-d9166b515e75", "comment": "Malware payload (Dridex)", "value": "ed27cd813c1d3aa8e18566f7eaa974da2a5c2009", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156902, "uuid": "37f2ed40-ac9e-4439-9f84-77e8598affd1", "comment": "Malware payload (Dridex)", "value": "3ea77cfa76ebf7c427bdee435405524b670d939454cd007328f8880553330f75816e0eea3b1a84357e7fdad413020fc7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156902, "uuid": "9ec7b310-e9d1-46b7-94d4-1a5183bfa4d2", "value": "T1C65402593A53E14CFE5F2C7C4CAF16F0AF88DCED2600167F65B2A25CEAD06C64DA0199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156902, "uuid": "259e1b8b-2127-4f6e-b5c1-4e661cd6d003", "value": "6144:SxtZbAPPimNA/kjoitkd7S1oWbHMVM7tqS4MjfX5Vs+J8:CtZbAPDNAcMt7S1PsV8tqwVJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629156902, "uuid": "56a01354-2b22-4c01-a175-de918856e6fc", "value": 292290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629156902, "uuid": "d350bea9-eed3-4167-a79f-6eefb3e73622", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156902, "uuid": "97749ff9-e901-4601-b7cb-f4b66fef8cb3", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_6_24306.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce697d5d-fedc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629150987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150987, "uuid": "81929f64-746d-4fe1-87d7-0dbaa493e56f", "comment": "Malware payload (Dridex)", "value": "a2110b339ee7511bc42a389721a452d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150987, "uuid": "89d40527-815f-4a64-b6d5-c8400c9bb5ad", "comment": "Malware payload (Dridex)", "value": "6e58ec07df73899b9f19c643d21d686353f25c376c5a1a13b3bab8066a8b95fd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150987, "uuid": "33466376-26a3-4ed6-ba3f-8a83f544f112", "comment": "Malware payload (Dridex)", "value": "24aa485181752647d6fb0dcfb50492a13fb90c59", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150987, "uuid": "4ab29dfb-ea02-4c0a-9832-99f50445e29b", "comment": "Malware payload (Dridex)", "value": "fe22888c7513549be844eafa4b4f996375f98f13279e755e8039a2f449ee3587e46bfd6a28ffdec935585d243af29fc0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150987, "uuid": "899faec0-e75b-4c64-a11d-b2b8f42b7387", "value": "T1D44401551A53E5ADFE4F3CBC8CCF25747F8CCDAB0900296F61A5960CEAD42D69C28886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150987, "uuid": "2eae9a90-5e37-4426-b66d-fc1bcd927f99", "value": "6144:SztZbAPPimNA/kjoitkJZoOfmrCJKRCKURjWdmCtQHI9+amL3:ytZbAPDNAcMkODJKgXRjOmuQHIH03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629150987, "uuid": "6fad8924-fd6e-4463-9476-d86e869a4e35", "value": 258805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629150987, "uuid": "7ae398dd-4a9e-47bb-9af5-3ccad4ec03f6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150987, "uuid": "722174a3-ad46-421c-abfc-66cffebb22b0", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_8_270854.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42fdd92-fe96-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629120905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629120905, "uuid": "832dd9dc-7713-4bcb-b756-b44695c3a7b6", "comment": "Malware payload (Gozi)", "value": "217f3f9501dd5b67d1d389bbc8818f54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629120905, "uuid": "a0a6ffd1-ed09-48b5-9315-336008f759e8", "comment": "Malware payload (Gozi)", "value": "6ebbfd8814613f8417993908a92b75bccfa8218ec48b84499b2774c27418fc63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629120905, "uuid": "4738c562-2375-48df-b5cb-b54cc0c27be0", "comment": "Malware payload (Gozi)", "value": "c7041b835ee73f55e9a2ee6911363bd11d373808", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629120905, "uuid": "b3fe6db6-e73f-4eb9-8704-934f7f6fc029", "comment": "Malware payload (Gozi)", "value": "862120c8d84d5b6558763b164241bf3c974dca984272ba30383f26584a8e9ae93338449f5cdc57f83be0ad55e73a6e90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629120905, "uuid": "ffb0648a-2785-4977-ab6e-cb6a4a94d1dd", "value": "T18C244A6AE3E40595ED6BC6B5CA53D61BE7F274092B14D70F03B4CAA66F07722B21C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629120905, "uuid": "8a6fbc3d-983d-4918-9cb1-5e8b5340b49b", "value": "6144:/HExb7VwvtKNbnvSxYNiyf+D3LumIy5o5H:cxb5wvtKRvSxY0G+D7uXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629120905, "uuid": "1949e425-0050-475b-8b60-a80007101fdb", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629120905, "uuid": "ff6bc53b-fa9d-47b8-83cf-789e1e3fa6c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629120905, "uuid": "7f2cde2c-58d8-4aa5-b60d-e7c2e8326f5e", "value": "21ab1d90000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9600b53c-fe6f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629104077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104077, "uuid": "d773cfdf-3c38-4947-a184-3159c64f6634", "comment": "Malware payload (Formbook)", "value": "243a8239525e29608f4302fd0eb4fac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104077, "uuid": "eedbcd06-5de3-4c29-b331-4c0c0a747914", "comment": "Malware payload (Formbook)", "value": "6f0a6315305a918cfaa7ec77275bd65a0acddbbac8b631ffe4dfb846a057a607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104077, "uuid": "65ef0e8b-c94c-4488-a555-92d5b306d6b8", "comment": "Malware payload (Formbook)", "value": "a4bb6dea844f68aa144b5c049606b430cc5f766a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104077, "uuid": "72c94bc3-4c1f-40e8-b31c-974d4cc06032", "comment": "Malware payload (Formbook)", "value": "61f650b43b18fbda8d633c2787e25403ec893a8d920a8cc914722bc3a228246eecdcb2faa4a1ff9ef70d31d1e692cf9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104077, "uuid": "15e8d8d2-64e0-4867-8bc7-094362775841", "value": "T15405CF7171A78A92F51F8A742538BD5403B131F3B9C68A391B5A514ACFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104077, "uuid": "c7470767-1995-46aa-96c6-759d64249c57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104077, "uuid": "a20b8c09-e591-429f-848c-571340315c96", "value": "24576:bLC0jLOu7gThUyuPfJDcOQuIvYZnytHPi:vC0jF7gTOyuPfOuIvYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104077, "uuid": "63aaaf8b-6c98-4366-8b50-9fe8e469168a", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104077, "uuid": "e6de2b5c-4ac2-4502-820e-ac88d11a6a24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104077, "uuid": "af5c75ba-56e0-4817-9342-f5df84869b81", "value": "Yeni sat\u0131n alma sipari\u015fi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974d036c-fe83-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629112669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112669, "uuid": "d5a559e1-9fd9-432c-b8d1-2a1ccb5fbf1c", "comment": "Malware payload (Loki)", "value": "fe65d613ad8b16de38950d57f10da32a", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112669, "uuid": "1dff3f0d-6734-4805-9615-2fb1ee1ede73", "comment": "Malware payload (Loki)", "value": "6f8775819fa3fcab050b0890e8809ce29774a7328f9fd0571b811ac85542af9e", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112669, "uuid": "da5f2181-4de6-4581-ba19-7b5e46237469", "comment": "Malware payload (Loki)", "value": "7d66d19db991983c6c8c2fdb7f1c6f9338f590f7", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112669, "uuid": "23fd2801-3320-4608-86c9-10cdfbc8cb4d", "comment": "Malware payload (Loki)", "value": "8295e778fc2a73221f7ae2b94cf893c46bc8b177a6b102068f6b703da320075395e3b86ffc52ace5e99b9bdba9c2325e", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112669, "uuid": "08f669a9-2fb2-4481-bfbf-2c2cb500a745", "value": "T18F55BF7171A78A96F10F8A742578BD5403B231B3F9C68939275A6146CFEDE983F4820F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112669, "uuid": "3e14c402-ecbb-403f-af37-636d28580d7b", "value": "12288:wKftcn1U5MePFzpZJXj/6bRhQOwyOYuvbbTCQJ95JOEPpBja:7ftc1UacJGbRhQOw/bbbTCs/HPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629112669, "uuid": "283e5ca9-97bb-4ae0-b01c-f38ae39792a4", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629112669, "uuid": "73ca4deb-5bd5-4be1-96f1-768bdf15cf76", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112669, "uuid": "3b19c6ea-f2e4-48ea-b4b5-c572ee6892a9", "value": "DATA SHEET.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba30afb3-fee0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629152671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152671, "uuid": "6566e82d-8502-4094-8a6f-a0b4ef0a540f", "comment": "Malware payload (Dridex)", "value": "53f4946c0b637e6feaa17038259ae084", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152671, "uuid": "6fd1d1e3-a286-4f56-8aeb-750dee47d75d", "comment": "Malware payload (Dridex)", "value": "7000ccf79a48e2ce15eb3c46a0c56e9cdccbc917de56b279dab3514fc1f80d2a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152671, "uuid": "2c1cc08d-4192-4731-af9f-1c49792378d4", "comment": "Malware payload (Dridex)", "value": "6cd474d9055b169b6b6df59e2ff69e303e5d4e0d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152671, "uuid": "04fb7cf0-a46b-4235-9529-66f69568f5b6", "comment": "Malware payload (Dridex)", "value": "217c1c6037a19613da50b28488f86746d349120edf27f2087f0a1057f989a5945bfe683aa81dddf17159b0d122eb0c8a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629152671, "uuid": "ede31aab-dba0-45d2-bf9d-5267d8b0dc64", "value": "T16844F1596A53E55CFEAF2C7C8CEF14B06F89CD6E0900693F22F5A50CEAD03E51C29586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629152671, "uuid": "60bce25b-a3df-459a-b803-ce3ec86fa5bc", "value": "6144:SbtZbAPPimNA/kjoitkuWFKzsb4+cBh1OFRdv08Sw:qtZbAPDNAcMhFRbrcuzds8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629152671, "uuid": "89a5b08b-1f65-48bd-9b08-62dcc0d5b3e2", "value": 253644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629152671, "uuid": "6ac67546-a380-4a4d-b9ee-b2b806c672c0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629152671, "uuid": "542b8159-1de9-4b5c-9f3b-432e50e81afb", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_5_668625517.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75bd890-fe89-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629115273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115273, "uuid": "b6ef0ab2-fe20-4186-8175-aa7f57402907", "comment": "Malware payload (RaccoonStealer)", "value": "2cae1b3be4c37e8f0ca5dac99dbbac17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115273, "uuid": "a0f88b30-7065-4f38-9d3c-14fbd86a1807", "comment": "Malware payload (RaccoonStealer)", "value": "7045ebc8901b28437b116f9ff37d6e16caf2b47e3b7986cc233add8410f1ec9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115273, "uuid": "99e82d3b-bd2c-486a-aff2-884f35450f6b", "comment": "Malware payload (RaccoonStealer)", "value": "fea201d9f1b3d81c67abead708afee8f619785d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115273, "uuid": "e649cf18-0a56-4489-8e08-d5e556772f06", "comment": "Malware payload (RaccoonStealer)", "value": "fc2486828f6a431bac2ad7ef6fa4f78a4192bb91d59e6a7b580ac0f69193f1c940c288cc1c1246b4062fc1bbce82bc70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115273, "uuid": "5ab2be47-daea-4a8f-8b07-d728deeff525", "value": "T16D4533E598DC2217DC4BBC767CB06BCB2B25B5911680C5AFCF149EBACCA37440199D4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115273, "uuid": "1afd8d33-427b-4dce-9ab4-cb55e79ae1e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115273, "uuid": "6372d1df-f5aa-46b8-8ae3-0297d12bf5ca", "value": "24576:kiKH63AanJL5WRxc493rVedPdiHxO0KQJ2dJd0+Tf7Lsg77R:vZA0L5WRq493heB2ydJ/LsS7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629115273, "uuid": "8d6122df-3afe-4c16-ab42-318a072e1046", "value": 1214464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629115273, "uuid": "093dfb97-dd34-43a1-b48d-b8f900d3fb07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115273, "uuid": "5755984f-9617-46d6-b502-cdd057bfa0a8", "value": "2cae1b3be4c37e8f0ca5dac99dbbac17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3e8e1b-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629126051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126051, "uuid": "ffc9a97a-89c7-4a1d-9c1e-b46575fe9d3a", "comment": "Malware payload (SnakeKeylogger)", "value": "2ac2a7662fa73228c9826a8b1d5d68d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126051, "uuid": "52061d96-a0b6-40d0-9129-d1a2cd50e47a", "comment": "Malware payload (SnakeKeylogger)", "value": "70c7f6e9cef3d53a8ee65a073a24236055f3a276f7bf8c6e5f6c9fc7341d7e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126051, "uuid": "1b8e3c2b-c6f9-49d8-b4f4-5b5fb7ce1374", "comment": "Malware payload (SnakeKeylogger)", "value": "ffe33d19c19fa18f980782f6c32023c7c3c3b78f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126051, "uuid": "ff69e072-63a2-47fb-a663-7f2aa3bba6ff", "comment": "Malware payload (SnakeKeylogger)", "value": "12dc609f1e0083f95be202ddbdcb62f21f782a7ca79e47d4c3aa2daad21089eb1dcf7ad9a61f396780a6ffd7c8840f75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126051, "uuid": "9909c124-42e8-4157-b824-ca1d7dbb914a", "value": "T1E4F4C07071978696F21F8AB42578BC54037271F3A9C68A391B5A6146CFEDED83F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126051, "uuid": "df9dd92a-392f-4351-9337-7136894943b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126051, "uuid": "3b8df427-625b-4f44-ba28-c9ea66a36eb2", "value": "12288:T7+5JOEP4baYENv6k1302VNk1fYHHXS+oC7u9clYs7MjPd+I7WqrpUS0Bja:fGHP4lENvPlVNUOHXS+DjYhhaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126051, "uuid": "f5ce10f4-e5f2-4e0b-b0a7-466e4cd7317b", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126051, "uuid": "9b8707b2-4ead-46a3-9638-fbeba8058027", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126051, "uuid": "0570ea78-934f-4ef1-9189-9358cb7b6a8c", "value": "Remesas Aceptadas_160821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0570911-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629132522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132522, "uuid": "3a15ea6c-9de8-436e-b14e-afb1cee38446", "comment": "Malware payload (AgentTesla)", "value": "b8bdcc29545af3d849706008a36dfc99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132522, "uuid": "5fc72c42-30c0-4979-aea6-d03b1a0ce67c", "comment": "Malware payload (AgentTesla)", "value": "70cc8f537f5ec180a01c2ba94066bf4fc9363f6e270bd76bd33834c841480440", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132522, "uuid": "07afdc71-475a-4e5c-919b-bc85ad7c477e", "comment": "Malware payload (AgentTesla)", "value": "d2773080d6e0d15b203d5c30b0e0bdc0bb1cce8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132522, "uuid": "54a5f126-32dc-461b-bf24-a6c71bfacd4b", "comment": "Malware payload (AgentTesla)", "value": "1ddfa03e80aa443c2f87423a51d165d7120da901f290877c8da55dd3045a5270cbe715cfd01782a9e691c051ced758b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132522, "uuid": "56a717cb-2634-446a-8ada-5d7db306f916", "value": "T10C43EDADC15706988F86ABB8171F6F85014D7A3DF788A93336749B702BE1C7B911293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132522, "uuid": "619d99ce-c6fd-4288-b8cc-089cf17f546b", "value": "384:fmCdNrDWv8Pgzo6Pu97lpeWXpYhVeEqf2zo3zOh5j:7vrszzW9s8jlqht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132522, "uuid": "158a4198-fb53-49e9-a280-d4fbdab1e710", "value": 58190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132522, "uuid": "f85374ea-10a9-460d-9f18-461e129e3769", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132522, "uuid": "3099f31a-2572-4b38-8d67-73c23c0c996c", "value": "Quotation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b6b52a-feb3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629133121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133121, "uuid": "d16a2425-f7ae-4e47-a1a7-c9540c8a938a", "comment": "Malware payload (Dridex)", "value": "8183a32219a628da49bd3109b86c5650", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133121, "uuid": "ca9bb946-9151-4b6f-9314-94209ec42575", "comment": "Malware payload (Dridex)", "value": "71c256342bd30087759e4395121e14242f0264e865a94209ea089df7ea39395b", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133121, "uuid": "8feb6125-cbb8-45e7-894f-199420eb6951", "comment": "Malware payload (Dridex)", "value": "40c706a794a96c8f6bf4c47363c904a5d59088f2", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133121, "uuid": "a87976e5-44b1-49a4-82ba-455462bbafdd", "comment": "Malware payload (Dridex)", "value": "3f6fe2c40a1efa07a9b2ed2a1f29a016a9558273b0f227af81727f565b5afe6d583ef1b31ea2698cad699d1766eb49eb", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133121, "uuid": "fb442755-0b64-4c8f-8636-89e39c1ff934", "value": "T1EE44022BC55C5943C88CD37B7E5B286017C927629719B2CE7AA23E3F3F091A71BE4518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133121, "uuid": "989b30a7-6c5d-41a9-9bb0-9bb85460fa5f", "value": "6144:UogkLjLhOafClctTex+eGleQf3vrxO3Tlqva03Eeze+U:xDLZrClSbhwQdqTlNgFzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133121, "uuid": "943f18bb-e6e7-49f5-8f90-f665a366f882", "value": 271029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133121, "uuid": "a751e5e0-406f-4140-a8ba-5ee16811e4a0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133121, "uuid": "b75a52e0-dd3d-4a6c-9ce1-9d99af94d296", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.2350020711.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de81ea57-feb9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629135982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135982, "uuid": "08a101e1-ffad-4a15-aa9f-12075804fa6c", "comment": "Malware payload (BitRAT)", "value": "975d87e24e881a6d224d37b25a7c8a1d", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135982, "uuid": "0ae05017-ca8b-41c0-bf1b-22501343c5d5", "comment": "Malware payload (BitRAT)", "value": "71c81318d16023aba7c537168d68b7d87eeeb085725d0904c3ea7298fc43d7e8", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135982, "uuid": "54b5e1c4-68ef-4217-9fc5-51f30b268b2f", "comment": "Malware payload (BitRAT)", "value": "836373fee93d77cf54eddc8c58a5b5fc2a6d259e", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135982, "uuid": "8e364bd9-3aeb-4a15-9879-62b86911b140", "comment": "Malware payload (BitRAT)", "value": "d49b3ed7e19176f886f9150d46a2cf8163bad0fcfde14e518b5dc003d4d833c06d0dd0f721dcf4b02addf024ca6c00f5", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135982, "uuid": "6532bf04-e6be-47ef-8e9a-eaced943a5f3", "value": "T1CB8533C222C2D126E7DC98F3064BA7B25170E773741CE7762E78DF0B3892792B9506A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135982, "uuid": "bcb64f62-42db-4201-8c5e-a0982324bc2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135982, "uuid": "afbe63e0-de21-45ef-8f71-77af630e724e", "value": "49152:+kI4ZpVNoNhRfKW7dAF1EnB0TSgCYp5HwG+uTiVkD+bV:+YZpVidZC/aB6ZpGXWD+bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629135982, "uuid": "6b2c2de5-91a6-484c-9fef-b1d89ddaa5c3", "value": 1814528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629135982, "uuid": "52c569ef-79d4-4323-be1b-c1768af27acf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135982, "uuid": "3c889a94-514c-4460-9084-dcae8d00f533", "value": "975d87e24e881a6d224d37b25a7c8a1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94de34de-feca-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629143159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143159, "uuid": "dbceb9e9-c534-4046-81b1-0179a1a49474", "comment": "Malware payload", "value": "891f06c30ba5dbaad5e81f3a86e2be91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143159, "uuid": "9cb915f3-85b9-4e0e-b57f-603b26215ddf", "comment": "Malware payload", "value": "71da7b8abf6ed72ebaa2f974292705912d11f7e8184a8a3e9807fe1b495008e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143159, "uuid": "e829bbf3-0410-4db9-bd97-383f7442cb56", "comment": "Malware payload", "value": "030c3a1946c42a5b9cc79e8d20f95ced4ec69f8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143159, "uuid": "033d4b12-25aa-46a9-aa5c-4def04581c43", "comment": "Malware payload", "value": "6653057af716f644ae9aa846394a4749d3db3e5a5b3a1e3bac85bc7fe21dadcd95c5132feb68d8651de62386e060db51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143159, "uuid": "814fd932-e0e7-4ac5-9922-ea85f51c7fcf", "value": "T1E5530264661308CEC4363CBAB9CFC66739C72B29345F40690479E6BB2AF315CE9E9315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143159, "uuid": "81f5352f-d362-49d8-8ed2-ca73bd92048f", "value": "1536:XtBTX941eYF8NblpuvnwanQ3zWYq40LZ5t:biMYFJvw6Yh0bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629143159, "uuid": "b12111cb-c223-41c0-b484-56cf39b5971e", "value": 61920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629143159, "uuid": "d74ac3a9-515d-4726-861a-b258d23a0d10", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143159, "uuid": "77ce52db-054e-4cf3-b1e6-1285f69ef97a", "value": "SecuriteInfo.com.Trojan.GenericKD.37405821.8610.18780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4d46ed-fea9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629129004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129004, "uuid": "a9e3b030-affb-4d81-96aa-3ac877a2426b", "comment": "Malware payload (Mirai)", "value": "117afeee54801eeec8535fb83013cbad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129004, "uuid": "14017484-1e08-42eb-b983-95e611e2187a", "comment": "Malware payload (Mirai)", "value": "72781ba041cac16a3296f148151dad0478f4a83eb8bec8bc331e623448797b9f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129004, "uuid": "f0f3cfb5-cb21-4a28-97a3-f5082d57ae8d", "comment": "Malware payload (Mirai)", "value": "9dec154b10b6a6fc77533ae11c6a1e57d891c29c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129004, "uuid": "dbac6bbc-1392-4a8d-a22b-00d9bf9c4ae9", "comment": "Malware payload (Mirai)", "value": "1fbfd424dd4f3cc36e5af9facaa5a28269d28914f662eaa86647ca1f275e899ba2b7fd183cb68b3fba0d7216cb807998", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129004, "uuid": "0d00dae3-7a73-493b-9b54-fab06583cf45", "value": "T1A1135CC5A053D8F8EC1705712173EB328BB7F47A2179DB87C79AD932AC91601E10E2AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129004, "uuid": "85c6c98b-182e-4a7d-ba68-e5fa63686545", "value": "768:xiM6uHBEx+zxDrZcxLt+Wft3Ofc3ZcsLgZJ4wqkHxr7MIpq:xivkBEx+zxDryxx+Ot3O3JfqkHN7Mqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629129004, "uuid": "f2fde313-1426-4193-ac9f-d81d5eb7a334", "value": 43248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629129004, "uuid": "dd34f5b6-20c5-40c8-b8fe-a5ef10255014", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129004, "uuid": "f87d8a28-d719-48a2-8819-13bc3bbc0a97", "value": "yeeted.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbab343b-fe85-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629113616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113616, "uuid": "5cf9f199-5fe2-455f-933a-44e8c4a7630b", "comment": "Malware payload (Smoke Loader)", "value": "084f180ce78ad68723e8f1115036a8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113616, "uuid": "0f9b3dbb-3321-4eaa-99ac-4a53d2e8bb34", "comment": "Malware payload (Smoke Loader)", "value": "730d5cdac8d6180133eefb3433f835ef496f0a8a1eb80006536878fc638a17fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113616, "uuid": "2fbb264d-1c7c-4eb1-861a-bea4e0e09520", "comment": "Malware payload (Smoke Loader)", "value": "2901b9bd9c6ee9e321e733f05879c42f30d9f308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113616, "uuid": "8c752f87-a69e-40ce-9730-73bfc6c8d4ee", "comment": "Malware payload (Smoke Loader)", "value": "0b9ee891c350f65e6cca28ee21f7b072e2c0d2539716c4f1c5dd8eb1c3f86cc76798d7d8470e73253009c3ca689e5a5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113616, "uuid": "3f8ca67c-bdc9-482e-bfda-1349da92271b", "value": "T1EC14AE2DF98FC072C391343C44B38BAC0928AB60DA5BC57B17896A5F5FF0EB05666349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113616, "uuid": "a48f35e7-6ef9-44bc-8a13-3fc416cb7585", "value": "894d0e2453b674d7fa4cc3ff89ddc063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113616, "uuid": "900476ef-e2ed-4053-b697-805efebdddb8", "value": "3072:C+0L+WO/XP3kMmIHh0jsoSBNB+Rzc/m/Z7yBRQ656Lsj:SLon3kMf0yuc/mMTP6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629113616, "uuid": "806d1cb4-2f18-4bee-9187-5ac85bcfa830", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629113616, "uuid": "04652c32-0cc5-49c9-b23b-6bc20b029c36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113616, "uuid": "a3c3eee2-4ed8-40bf-9fc6-c80c1f9a830a", "value": "084f180ce78ad68723e8f1115036a8ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95885da9-fe8a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629115673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115673, "uuid": "7651fd65-68d3-42eb-b6d0-c34434ca85f3", "comment": "Malware payload (AgentTesla)", "value": "362ff10477583ede83cb6ef32187bb3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115673, "uuid": "8d8d050b-0c14-4b72-b120-eac22b6ba205", "comment": "Malware payload (AgentTesla)", "value": "73e49663ba0a3ddcae4390264cd65a34b98554f575261e8959db7f4e744b7f1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115673, "uuid": "0e4934f5-a42a-43ed-bd7b-51483f2c8403", "comment": "Malware payload (AgentTesla)", "value": "ef308b2d6a51147c3f380cf849712a1f0072689f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115673, "uuid": "93d3ce2e-90f7-4352-9531-755cf0628efc", "comment": "Malware payload (AgentTesla)", "value": "75fe2d0144a7e443dab4328912359dd254f55816f46535dd296827680277461621c7fc8d581828719256f587c562d15b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115673, "uuid": "fdad8b66-0bcf-4971-a4d1-485f742b4d85", "value": "T19781D9305B4C0E93D6475576E6847E5B05BAFB6BCAC7154072FCF9A10B3F2BA0C62506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115673, "uuid": "a57da2dc-ed0c-4b05-9273-3c47039dd3a3", "value": "96:Zq17NHeRjgSOqwn7MFeo7aV6AKsWmLQPXXh8uHZcBAc:ZyxQLw79oeV6AvjsP6ulc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629115673, "uuid": "21efc762-f717-4df1-ba9e-b5a6c805de53", "value": 4176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629115673, "uuid": "1a4a0444-2ae2-4ba0-bbb1-958243593c61", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115673, "uuid": "ed437512-1f61-4726-9fd3-6ca496c26aaa", "value": "HEISCO_1212018.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1878c5c9-feb7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629134790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134790, "uuid": "473d5090-6225-4857-bb62-74da958ad722", "comment": "Malware payload (Formbook)", "value": "2acc48ac59c4d56bd7ac05e52cf1117d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134790, "uuid": "fd9704d5-140f-40c6-8625-c68a3cbc609b", "comment": "Malware payload (Formbook)", "value": "741e54e8d4c95d3a939bea610b4805e417a0662e17e5811aa72466d74f0fe9b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134790, "uuid": "53c230f2-9af3-452e-a3c0-cffe1fbe5ba3", "comment": "Malware payload (Formbook)", "value": "ebfd27d0fd630d2212934a92ed30d66035ab16ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134790, "uuid": "9969acc0-093a-46ac-8766-a5a10bc1d217", "comment": "Malware payload (Formbook)", "value": "79f47b17f8058c28d1c72a08f6a5101d58b23ea5335dbb20de19660c5bcc90e6d89708631d6389f9405818bd08ce498f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134790, "uuid": "0ee4c05a-6e00-4859-90e3-683d4ba0c4e2", "value": "T12E45E73916B82B27E079E369E6E44417B3E0945FB225ED59BCCE03A74206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134790, "uuid": "45af9d0a-9d8d-4951-9a3e-57806a82c6f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134790, "uuid": "4d7b9b58-7e1d-427a-93dd-fe029979f81e", "value": "24576:6lQ7oY8FYMblhBIgzqRDPzdzN543puwbmF:wQoyA1ZqrdKjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134790, "uuid": "87a820b8-d7ed-4cf2-bf7b-1abcdc9b55a6", "value": 1200640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134790, "uuid": "9fcc766c-0614-4b3e-8a44-0a1a5182de39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134790, "uuid": "7a070598-8771-42c7-ad01-474a252dbee3", "value": "Urgent Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671807bd-fe84-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629113018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113018, "uuid": "7efdad9b-dff8-411a-bc5b-f44dcafa8ca4", "comment": "Malware payload (Formbook)", "value": "12bb2a983fc09ed07579c60d0e396551", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113018, "uuid": "8f8987dd-eabe-46c7-8259-aa6e5e584938", "comment": "Malware payload (Formbook)", "value": "75de6a436c06db361958df9e1cd39e7e72e44a8e202058c5dc93233a5b135e6f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113018, "uuid": "25b589d8-e684-4b93-8fe7-d039e34c5c8a", "comment": "Malware payload (Formbook)", "value": "f90c37191d8a31aacc69c4ae3aec0328d53673ac", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629113018, "uuid": "dc31dee5-c141-40e2-9aa2-ff65736632e6", "comment": "Malware payload (Formbook)", "value": "d3bdca76f2d65a718890582d94aa9daffc49886c8561fc9ed4a450558d7d20bf8add4f1c3a6568180ea82e646e9e47c0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113018, "uuid": "4478d6f0-d583-47ce-9d32-9741a7762b19", "value": "T1F1E433A4F03492E00B16E8B6D574192796EF53F0CFDEA5B74744629E4EB32AE0900F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113018, "uuid": "0427379d-d74f-4810-b21c-3c3de049a84c", "value": "12288:reIQB5+xLusf2hru1otRmf9Ozg+4roWrnGtRSIf/NzH0yWb4LwzOh+4:BZETtYFPLoWzGt4q/NzHHWEEiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629113018, "uuid": "2ee7d407-af3b-439d-9f13-b1e6f3ea46c7", "value": 686973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629113018, "uuid": "6636c2a4-598f-4a93-9ebf-73a714027701", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629113018, "uuid": "e557d602-a28a-412f-92f6-bbe93ef72136", "value": "Confirm received PO 4500640396.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd96ca5-fea4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629126907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126907, "uuid": "17811540-d1d8-4cf6-af79-5f4153a15a50", "comment": "Malware payload (AveMariaRAT)", "value": "69ef3ef3505b304fd574d977f24aa7bd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126907, "uuid": "fbae1a45-9ea5-49b4-9c0e-b4075564a98b", "comment": "Malware payload (AveMariaRAT)", "value": "7661ca31ed888f3f84bb5897d3c9fbf8dbb62fb71429303da2301105dc18d7ab", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126907, "uuid": "9b724ce8-c651-4434-87a1-d3bb0c4f6c03", "comment": "Malware payload (AveMariaRAT)", "value": "13512faf41e2fe2b71ec7c450cda2cd88a85d6cd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126907, "uuid": "67acb25d-95ce-476f-b9f3-345afafc95a4", "comment": "Malware payload (AveMariaRAT)", "value": "44ed52c35059c41820c92ada4210dd84503ee7666199d52da041ba3280ae3eabf66d69951253d865c642e5cce73cfbc8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126907, "uuid": "8c6cead3-a4c7-40de-a5bf-7a599fdc0685", "value": "T163318F04703359D3EA06D42231A731DDBD312708AAFB8B71155EEA42AA40DFF9C5CAB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126907, "uuid": "9f2de0b9-ee7e-4ea2-b280-f1df28095cb1", "value": "24:rEEPdqnWahNwDJPpUI0I2rWGItUIZOIIIPITI3uFIJwIEIfILdgcjacdgcquU2bD:3+Ex2Ahn1wE+FIzhg3Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126907, "uuid": "d1336997-ed05-48c1-8c6d-cb493578e5a8", "value": 1600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126907, "uuid": "8c79e736-81ad-4687-ad20-2a4c1737d00f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126907, "uuid": "b5340dd8-345c-4584-9bf8-9ceaa6590320", "value": "Y03156-Payment-Inv0ice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81af22d-fec5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629141071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141071, "uuid": "1b218920-c4f3-4fd1-a0b4-9ae81f903217", "comment": "Malware payload (Dridex)", "value": "1137bd9ff84b94b70da1b7f2db4b5c71", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141071, "uuid": "62fa09cd-348e-4135-8de9-bfab270b233d", "comment": "Malware payload (Dridex)", "value": "76923cc63132ac30ab668ad62c96e6780d2924733452a6de14e4d21ea43152f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141071, "uuid": "ce6e9883-e313-4c68-a5e8-6745f74506f4", "comment": "Malware payload (Dridex)", "value": "22b31b74a27ed877ff119e33672a9f3131a8b5a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141071, "uuid": "74e52522-32d2-4737-9b7b-b96defb8c09c", "comment": "Malware payload (Dridex)", "value": "e51de9feecb81351d9dab3c3cba54b27a1d5dc2c19dfac779de5d1b499926e9796659ef2f8cf8b80ee6fad2da465449a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141071, "uuid": "4d83e0cf-6db7-42e2-99e8-04f6177fcfab", "value": "T15D44024E8136F258E596A03A4CDE0FE927B85E3B29D05B16F5E1B10D3F06CEB61A414F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141071, "uuid": "5c8c4b69-aeea-41dd-b532-571f99050275", "value": "6144:SrNSLcq+YXEs01260E4THpQao3Mk0TZgIwR0g6+HSslLK:4PYXEs3E4THM3MlTeIwRx1yslK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629141071, "uuid": "d02b1506-75a1-404b-a59b-74954746f488", "value": 259925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629141071, "uuid": "9bdfd76c-2b8b-4a87-9d7b-7c6695a2cda7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141071, "uuid": "79b2227b-5556-4932-a9bb-46bd9c5d5cea", "value": "taxve_58772_20210816_36369_80911816.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcf5c8a-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629132571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132571, "uuid": "18af275b-8a7d-4d58-aa83-3334b8e24a32", "comment": "Malware payload (Dridex)", "value": "d32fcbe77518b3c277c992a6738c6148", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132571, "uuid": "10d6e9ef-a11a-4270-9e46-86dc243a51f7", "comment": "Malware payload (Dridex)", "value": "76c24f48f328ccac2edb7e0685cbfd346a3fdf0b95c2778a23aaadf4cde3f053", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132571, "uuid": "f914dd2c-558b-4463-94c7-53a82110d177", "comment": "Malware payload (Dridex)", "value": "4a0a4db03a78fc0c2f2ce6fecacc94303322fcdd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132571, "uuid": "df2b79a6-0a9e-4dd4-9415-ae4f1a179b3c", "comment": "Malware payload (Dridex)", "value": "fcfcaffb2c6eed47e0477913ae33a6391ccc6d02c33a080793d8b01189c08ff1736e57cd1d321727568bc387d6539789", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132571, "uuid": "bb509723-c5cc-4e2f-a740-e0986091050d", "value": "T1C364F1092D13F65CEF5E2C7E9CEE29756F898CBE050029AF62F4E25DE6C42D25C24096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132571, "uuid": "2aa4734c-23a7-4795-ba6c-9cf89e61fd60", "value": "6144:SttZbAPPimNA/kjoitkC7j48HW1XA2FDOicz7DuJ8deJTgU2FPki:OtZbAPDNAcM8ksWZA2FCdz7WTDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132571, "uuid": "dd86bfd1-56c2-4e67-978d-e75d728c5c20", "value": 333161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132571, "uuid": "c47a0778-3d24-4497-8b10-0662ff8bd716", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132571, "uuid": "e8bb7864-1db2-4612-8636-301aa75ab497", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_82608935.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6e8049-fe9f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629124575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124575, "uuid": "f46c7537-eb5e-4761-9b69-0e7432f8f307", "comment": "Malware payload (RedLineStealer)", "value": "4d970a2e52b9b8211c64097581942527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124575, "uuid": "0762b309-bcd9-4bfa-a2d4-ef9a6be63067", "comment": "Malware payload (RedLineStealer)", "value": "76cde08b521a97baf4aebab068d5c41fa03821dc4c4170a791ebbdcb6a26de64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124575, "uuid": "937abe56-bcab-424a-9f8e-ae6f6308024d", "comment": "Malware payload (RedLineStealer)", "value": "23db90c824e77ea619c3f771c75d919c703e9735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124575, "uuid": "70a8002d-0351-4214-b6d9-e9763cb96551", "comment": "Malware payload (RedLineStealer)", "value": "449f357378c9136cc747cfa90acb14f68c49c366fd71fdfa2ff4803c3ec63d39dd163c91887f9526b4a10ba5ac13f6e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124575, "uuid": "add2d5c7-e88b-469b-9ccb-126b501d3c50", "value": "T1FF35F033E6CA5279D299043039B4EF34C0B57E110715868762DCAE3B7AF738DD6A628D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124575, "uuid": "3503581a-1c5d-4979-9d60-437e05275ed0", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124575, "uuid": "f474d098-21df-4046-937d-318ac2d5bfcd", "value": "24576:SdW6C292GDnK/p61BLUEuG7W7Mmw87WVQ9Yaek4QpWMLMG:SdW6CLcK/w1Zr7uLpWa9Yq9gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629124575, "uuid": "516c998b-b150-4e00-9354-2b7c6eb056dc", "value": 1157522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629124575, "uuid": "d91d59a8-2eaa-430d-8ca0-81378cd4dba1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124575, "uuid": "c87e0c9b-243a-477b-9024-8b72b0a286bc", "value": "76CDE08B521A97BAF4AEBAB068D5C41FA03821DC4C417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3e61bd-febf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629138286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138286, "uuid": "7de59f84-d953-461a-bf37-7c04e913a1e1", "comment": "Malware payload (Dridex)", "value": "f03f74c039e033aa41093d9fbb802743", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138286, "uuid": "612516ba-2a06-4678-ab34-fe790ce6b2fd", "comment": "Malware payload (Dridex)", "value": "7802f1db1091eee3d5fbb096a605abcb52d6359cc8274cc1449fa65244254a3f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138286, "uuid": "39e3da46-8660-4204-bc73-791457a0e3ab", "comment": "Malware payload (Dridex)", "value": "b951b65b881b2724433e9520ef788da3f2febd71", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138286, "uuid": "7fbb751e-a14d-4f87-ae3f-83d1bf12fdea", "comment": "Malware payload (Dridex)", "value": "5c31ae1e675500ec04eeb6abc3a1abbeea1ee362fe21402d080c2c697db33adf1b4457abde2912f32bc3624cd3053bf9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138286, "uuid": "d38fc9c1-5abb-4305-873c-c8f03c204aac", "value": "T1A53402194977F060EA97A0799C5B0FED6772DE2B10D1AF05F9E6E20CDD0ADE7A04108B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138286, "uuid": "49071f68-7e60-4cf5-b3e2-f91bf5a7a230", "value": "3072:SPHAeN0RKSwCchO7e/1GrpdXx6sj848J9BebK1+FqEosy6gC21GrcIsXGDZ0xa:SPXNSLcq+YXEsEBeSEty6b2BIZZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629138286, "uuid": "f1d38aba-4dd0-4c76-ace9-5f312cca62bd", "value": 240092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629138286, "uuid": "aee4d469-ba87-4218-b4ad-9bb89243f125", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138286, "uuid": "8d847039-4911-4d75-bc43-d4fb0c9af7a9", "value": "_taxve_27556_20210816_86848986_349214.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e934818-feec-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629157537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157537, "uuid": "25cb6a28-0031-4623-855a-25fdb10e369a", "comment": "Malware payload (Dridex)", "value": "28ac586775d932683a5bafe9b1f204d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157537, "uuid": "edaceb41-8e6c-463a-a997-4722e9d03e6c", "comment": "Malware payload (Dridex)", "value": "78325606313732da527e56ea9ad05cb1c9ae705c4241d713327b3230c499d665", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157537, "uuid": "907d0717-6d30-4bb9-97fc-9e16c74f22fe", "comment": "Malware payload (Dridex)", "value": "e73643ec9fd603fe28c61745a7cf9da4e9151bae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157537, "uuid": "57a94e99-b629-4f10-8fb7-acc91f8f5c68", "comment": "Malware payload (Dridex)", "value": "e43cfea157e95688196ab9573d6fa95a66603160328732cdba601efb50bad3c1736a84904e8886640f29413e33f1a22a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157537, "uuid": "c4643b95-7dad-4863-8720-cc5b96197c21", "value": "T1F414021BDE4E1907C05DD37FBE172AF003499642970578EA54B3BF262E906A24BFB06D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157537, "uuid": "594bf7c3-b59d-4a43-a494-5f328eeefd30", "value": "3072:iJ/ogkBdPxNLhacbC1df4DPG+DsoITlIsjKceDp1KKn6Kt5/HPqJ9:UogkLjLhn4df4zGTpu5Dp1KK6CHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629157537, "uuid": "496d1fb8-d2fa-4b85-a53f-e5ce5a475429", "value": 203664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629157537, "uuid": "c19d9c8e-dd39-4ae0-9365-ac69269fbdaa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157537, "uuid": "6dc4d2f0-b081-450d-9c40-09c3ca59742e", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.9416375.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1a1f42-feec-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629157803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157803, "uuid": "f0664aea-7f26-4bfb-8c99-e615d839df88", "comment": "Malware payload", "value": "83020da8392e9f32345424c52fb1dbed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157803, "uuid": "4a149947-6de6-4aaf-9923-6cce72a50b55", "comment": "Malware payload", "value": "786102ac051979f183693f5414ed2985ca16d546d18a8f75603d89e6f78c9785", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157803, "uuid": "a27c6050-e133-4fc2-a4de-63951c2e7aa4", "comment": "Malware payload", "value": "5dc77e59565b683b210faf7996c47d48eb11f5bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157803, "uuid": "3ef012b7-eb5b-4eb1-b18e-c9e8174bbf3e", "comment": "Malware payload", "value": "f8438d6573d04b9a1f996b410ad23b78990585b48b7487e21711b52d646e7ef9185c9b84f7c5f19bbcc4d55686b01d14", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157803, "uuid": "37651a5a-286b-498a-b2be-52e6776ff525", "value": "T1CBE34C86FA408B13C5C51B76EAAF424A33229B55E3DB73068D185FF43F87A5E4E13606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157803, "uuid": "35ac17f8-7181-494b-901a-dd4ad40b6632", "value": "3072:nib6sxR464MQnJYqNMLK0cNdqjn7AOytpkAMn7maXWZ2M/9s/r:ubRp4MQlcn7AOytptMaaX9M/9s/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629157803, "uuid": "a7a11286-215b-4eac-9c5f-a24cb2542406", "value": 144087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629157803, "uuid": "fa76fafe-58f1-415b-89fd-d358689ed1cd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157803, "uuid": "50c5c5ff-b08d-4663-895e-fe924d3a4105", "value": "94VG.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911f1fec-feeb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629157327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157327, "uuid": "004c0e74-5bbb-4054-abd1-2be41919e5c3", "comment": "Malware payload (Dridex)", "value": "823864c944b0a3fc34e1db747f054f0f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157327, "uuid": "1e9ce7c3-526d-4313-8089-48be310f56c0", "comment": "Malware payload (Dridex)", "value": "789eeabf3f5028b8f2f381ba59b252eed007caf3dbcfd32e1dc30f2611dfb278", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157327, "uuid": "6153281c-d928-49b1-8a19-9f94b5c7ff1f", "comment": "Malware payload (Dridex)", "value": "e58c3a85e014e3b45a3ec60851103a1337036c6b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157327, "uuid": "30c1b6b1-b8cc-4304-b60d-e991a0e1ada9", "comment": "Malware payload (Dridex)", "value": "c913c10cc3d472ab56fd02efa18e8fc9355ed5a16395bf52f5c3dda3ab279f08be2d2d86c317ff66e0709f329c202157", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157327, "uuid": "97068e12-4c48-4150-b7c9-71c391354d79", "value": "T10F140227DC091913D14DE3FEAD922ED013859B06E207B1EE78712EAD7E5832257E345E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157327, "uuid": "09a5ac17-f2e1-4716-8ab2-2a820c8d4a24", "value": "6144:eogkLjLhvkJJAWljIr2JJh/Pd6RhAnkm8eb:vDLZ0JZjvJJVPdgAOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629157327, "uuid": "b6b3ef72-3967-4f4e-b15b-4c9920dd57d9", "value": 201292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629157327, "uuid": "3a4a27d1-c2c1-4f45-8c5d-8e56caf2b0cb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157327, "uuid": "684ecf6c-dbb7-417a-9bdb-717175f1e309", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.82907123.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b40129-fea9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629129006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129006, "uuid": "e326abe4-66dd-43d9-8964-52687a370f07", "comment": "Malware payload (Mirai)", "value": "8470dc8c1b1913f51e655669c70ad7f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129006, "uuid": "0264032b-3470-42b8-b88a-26d8d4692afd", "comment": "Malware payload (Mirai)", "value": "78cf5e950618a0cffc24938e830987b5d5ea81e1cfe2241c224c6dfd822adb4f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129006, "uuid": "474990ab-efaf-42a4-a594-04732447ef39", "comment": "Malware payload (Mirai)", "value": "ab00135a4d21aa87e426b0c37926bd6a66ff61bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129006, "uuid": "6728ea2c-f8a3-483f-9a7c-4c6ae95a0496", "comment": "Malware payload (Mirai)", "value": "13a566bd878c9a10e6cdbc61188712c6cefad91bc232a26d54f974906c4101b2732f3d8794d389e38f739de8b7e46992", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129006, "uuid": "7191b8b4-25d2-45a0-9461-0b2fa3983ca1", "value": "T155331881BCD19A16C9E423BBFA1E418D33256798E2DF33079D212F157BD682F0D67641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129006, "uuid": "c386ef1a-83fc-41cb-ae72-c5f28730cbbd", "value": "768:xGE8Uj/maIr2k+FR38I2TsMrUEwbou+cPejMlve51I8G2cNOatZbLH:B8UTm5rER3B2TsMrbwxNeN8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629129006, "uuid": "af183499-7bd6-423b-bdd3-8775412568cb", "value": 50876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629129006, "uuid": "2fb440a2-b53d-4fc6-b3fb-324f88e10dcf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129006, "uuid": "1e0e705a-233c-4489-bc3d-bb700709865b", "value": "yeeted.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d79e0f2-fe3d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629082373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629082373, "uuid": "927e413a-4843-4f87-a6ed-6e22bd676fe9", "comment": "Malware payload (RedLineStealer)", "value": "fa2170ab2dfa330d961cccf8e93c757b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629082373, "uuid": "2464cafb-b231-4813-87ff-cfc4969c7aa9", "comment": "Malware payload (RedLineStealer)", "value": "78f4272d2904fd5539aa41955c99968e0971e167a5d9b42389e9a51ab79cf1b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629082373, "uuid": "94c65e0f-c023-44d4-8eea-12bf67d2165b", "comment": "Malware payload (RedLineStealer)", "value": "d3fd7ae0be7954a547169e29a44d467f14dfb340", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629082373, "uuid": "1cd075ae-d98f-41db-a077-c75168073731", "comment": "Malware payload (RedLineStealer)", "value": "667492a3dd3cf5d436a1da3693794f9dd826d0909d25f23091fd21c77449649aea3c05f67d60a3c63fe554256110f817", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629082373, "uuid": "35291664-9ea2-4ff1-9fad-8cac8c77c4f4", "value": "T19C26225163EB3530E6A90AF5D1A20C304F7E6F562EE2C2192EB0F58D197CBB29C71752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629082373, "uuid": "a1a7db15-03f3-4677-944b-2e69ce802c79", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629082373, "uuid": "24c8993b-460c-4666-870e-0f02d3a8537a", "value": "98304:U4JDx7yn+uKUcLYZ0qIrAbkeLY7w1/gQVoXKwJ+Dvt9:U4RHuhcLYyJrmL9BkJCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629082373, "uuid": "7d10ef23-68e3-437e-8888-160005de8094", "value": 4520104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629082373, "uuid": "b5a4e971-b323-46dd-b31e-b673d571905b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629082373, "uuid": "d37144bf-0247-425b-8ea3-d00784c78a39", "value": "fa2170ab2dfa330d961cccf8e93c757b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6852ea91-fe97-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629121180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629121180, "uuid": "62c1d135-bf82-49e1-9bb9-790d7812f5d1", "comment": "Malware payload (AgentTesla)", "value": "d80f2c4803e1d577eead959e279f6383", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629121180, "uuid": "fd544b6f-dc56-4b7e-849b-2baa13f28941", "comment": "Malware payload (AgentTesla)", "value": "7a041d4a173438f8eac0113dbd4f958a25e039535339a3b5290ec1d51f20b703", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629121180, "uuid": "91d35690-68b2-4961-9fe6-c93b4f856a40", "comment": "Malware payload (AgentTesla)", "value": "39ef41adc3f5d107e9b0816d3f58c8fc4936ae79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629121180, "uuid": "bbba2aed-d3c3-4e50-923a-ffa3ba6a87d0", "comment": "Malware payload (AgentTesla)", "value": "ecc13e526e6d12f58f5f8bcc3186bbb83a8d485a72d8f0318b34bccace2d83569fbf29ea7ebc9229aa258bd2fc3c7683", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629121180, "uuid": "f0918202-7450-4af9-a989-8b1b4d835506", "value": "T12A25AD204254EEABE23421F5C419944A73F5D6A6221DEB8E7DC314E58FC4F0E7B92E36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629121180, "uuid": "f9ae7e42-0f46-4e69-a8d6-42ae1fc4b8b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629121180, "uuid": "ccb04285-8c3f-4027-8cb0-67e5adc421b4", "value": "24576:y4To/6ibWTqP0FQ3cp4Ff+/8tiLwpWH0loF+r0xqngXAN2rsBCRaDgRun0lwblhF:+13leqZhl9CWQJ8e4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629121180, "uuid": "d750e76f-9561-40ae-9470-cb18ff03d6db", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629121180, "uuid": "7ceb88d1-a114-462d-8269-437a3cb13d91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629121180, "uuid": "8243618e-bc0b-4d35-8c74-d36605eb542b", "value": "Order # 9872.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bff418e-fedd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629151198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151198, "uuid": "101273cc-6b92-4727-930a-a745839d03d0", "comment": "Malware payload (Dridex)", "value": "576fac94cc5f39cebf281fb795c928a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151198, "uuid": "4b41622f-e04c-41ab-9f0e-1f6ba70d5f4a", "comment": "Malware payload (Dridex)", "value": "7a6e7bd25e49ab0c5fdeae608fc79ae61a24f9d6048a8dc2e4cc48cf212acdf8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151198, "uuid": "1b87c902-5667-4c7e-9d00-611c87a9a530", "comment": "Malware payload (Dridex)", "value": "0dca05a624d075f64efe79578a63040492815e97", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151198, "uuid": "5c8b40f4-8b4b-4cc9-ab9a-66ff9e28c435", "comment": "Malware payload (Dridex)", "value": "aec5e33f6c675c0b5515d38f99817bcd69f873460a37859a1c5abc9f52a5a935a507c86d723d207b7a341d3ca24ad299", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151198, "uuid": "143b5bd6-d101-42bd-beee-7a6dc30bf816", "value": "T1834401149993D65CFD8F2C3C8CEF04B07BD9CCBA12102A7F25B1A65CEAE83D41D5658A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151198, "uuid": "8197117e-0efa-4a01-857d-193b680792de", "value": "6144:SktZbAPPimNA/kjoitkUsvixae7jGNWO4KI48rUi3+:ftZbAPDNAcMEsvMae7SNB9qfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629151198, "uuid": "1ea5f92e-e2bc-4191-8eee-07d9e7065edd", "value": 264252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629151198, "uuid": "108cf884-c041-49e8-84b5-5fc3fdfb3807", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151198, "uuid": "750b7729-5286-481b-ad64-4dada3edfa85", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_74317.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4502bfa-fe4b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629088639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629088639, "uuid": "a2aef8cd-fcca-467d-816b-3752214f65b3", "comment": "Malware payload (DanaBot)", "value": "5de1fe735f2aa290f49d687ed5888bb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629088639, "uuid": "17e2e584-cabd-4c6d-878b-61b6ac06bede", "comment": "Malware payload (DanaBot)", "value": "7aa11f82498f11270ec3b7de752a94e22a95057d51ec4d39998e2f101e448331", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629088639, "uuid": "4f6cc8f9-e88a-44ec-baf0-993fba28e5d3", "comment": "Malware payload (DanaBot)", "value": "3b01ff774d9cef6faa7c5e5d595275eb94b43f71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629088639, "uuid": "13d1d134-966d-463d-b1a7-9ebd0b7c4da8", "comment": "Malware payload (DanaBot)", "value": "8773e8a1c9227c38c05581de5fbe5af376a05cce2fddaf6e7969f2ab1d4fe8a84e027aff0b24a808bb2ba0f794a8e319", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629088639, "uuid": "c1ae452b-42ba-4e91-84b0-53d439f7f898", "value": "T13035232D658FC132C75BB67440B7C68C4AFA9F21E6470837178C2AAF6F31AF0A591356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629088639, "uuid": "9738f559-1a63-4680-92dc-b129796b8e56", "value": "894d0e2453b674d7fa4cc3ff89ddc063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629088639, "uuid": "fa0aac21-3dc5-4061-a720-12c4f2942b13", "value": "24576:h9ierLYN6ciNWakvRWStmmbVyVGuYFbdLs:merMpiQhfbjDhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629088639, "uuid": "3e4bd520-5ce9-4d79-8179-71fb8328aa5b", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629088639, "uuid": "1ed1d52a-533a-43c7-9212-0e8799a6ce43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629088639, "uuid": "a6e090ed-0704-410d-9b86-03f80c5bf801", "value": "5de1fe735f2aa290f49d687ed5888bb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ba306b-fe5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629096774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096774, "uuid": "92d3cbf8-784a-440e-88b2-9fc197950377", "comment": "Malware payload (Loki)", "value": "adf1b6020b5820c4cf5fa6560f1ba54e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096774, "uuid": "9211f8b7-35be-4b7a-bce3-b1f8667f11e0", "comment": "Malware payload (Loki)", "value": "7ae5ca5559c5a2c4e21ef72ce6db53d7d2fcedc005d42982ac9db5063bcb4ebd", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096774, "uuid": "d959b7c9-a20c-4a1e-a3da-9b4b600dd5fe", "comment": "Malware payload (Loki)", "value": "57e3ca403c9244f0b69a8f37811b24d39160cadb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096774, "uuid": "b2ccb71f-e4a7-4520-8a88-d9fc95b2c6bf", "comment": "Malware payload (Loki)", "value": "d9de1b83a4c8dea45c2116c7087cf411a0366c98a0f25844ec435d26e824b937bcef56530a4c14edd9bf051c0654c97f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096774, "uuid": "1031b975-2a9f-4b2b-96f7-82b7a4932243", "value": "T1CB55127EAD416BE9D12E323D68EB6578806C3CC516794183329D32E331B6AF7AD1E047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096774, "uuid": "e66ca400-2fca-4948-a0c4-3075c34decb1", "value": "24576:MjNX4I8HERbLG6LYZ8kG/sPtFYDYzr+umar012bxCt2MJgM/vCKL6dYqBih4LRRY:MjNoFHERbqZ8UPD04rjTAwbEtl7/6dYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629096774, "uuid": "9ed6bccf-5355-42ce-9c4b-dbc661b55257", "value": 1381400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629096774, "uuid": "38a0c1b2-42a8-4204-97b6-93cb1c7a7294", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096774, "uuid": "0cd95b35-f0e3-4c8a-b64f-f0281bdf14ad", "value": "Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b518ba89-fee1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629153092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153092, "uuid": "b9fb1022-0c59-4d52-bb23-7e69630579ba", "comment": "Malware payload (Dridex)", "value": "5a0232a75114faf64a5098459954ff49", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153092, "uuid": "fbabad76-8ed5-48c1-921c-f16e4551ad2c", "comment": "Malware payload (Dridex)", "value": "7b559a391e8393323f1660f3bf80fb5a46045593cedc9b8459dbc9262ace77cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153092, "uuid": "6acf483f-7017-4689-aac0-71969f90dac5", "comment": "Malware payload (Dridex)", "value": "e81c61b3f70bac962c398ec8e1a03ca3be472316", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153092, "uuid": "39f2c964-13bb-4f6c-a2bf-a8c727ee6a69", "comment": "Malware payload (Dridex)", "value": "e4f7a98fa7d8d7be7c16bb0e3f3000090a2ac86a17e4a707599d5bef9a914caeb194c0b6357ddfefb654700015a4b27e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153092, "uuid": "1983b18a-1533-486c-bfdf-1a2bde47f678", "value": "T1D264014AAA1BF52CED4FFD7C8CDE34B0AB4CCD9E06405A6F20E1924DEAE42D04D5A056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153092, "uuid": "faf2cbe6-0332-46ec-94d2-9aa1c7626d7f", "value": "6144:SxtZbAPPimNA/kjoitkmgPW7YwHib6dPRMemP1wkJg9P9OidJ7xMP0z:AtZbAPDNAcM2gPW7X0kPRM/PeLJ9OidB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629153092, "uuid": "e5238180-ba36-4ca4-9cb8-ad10e8d0f490", "value": 329379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629153092, "uuid": "5e7d489f-0b3a-4816-80fd-8fe0219a2293", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153092, "uuid": "358bf70e-d948-4bce-b1e4-b6f56b66ef37", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_1_98869.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f583d4-fe6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629102914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629102914, "uuid": "6f5d9c78-76a4-4fe3-9763-ca864c2c42a6", "comment": "Malware payload (AgentTesla)", "value": "991f2dd4eb5275b8d3023491ee2bfea6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629102914, "uuid": "eba291f7-7305-45bb-a1f9-45df7e899234", "comment": "Malware payload (AgentTesla)", "value": "7c8d9190127308a71e8cbe83fbca22d4894d5842fd41997e593c7462fe0c365f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629102914, "uuid": "769427d7-50cf-40c7-a9c2-aa537ae859f7", "comment": "Malware payload (AgentTesla)", "value": "323370fdb19c15845be23265bbd78a11940451e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629102914, "uuid": "9b7ac0cc-c9c3-4c38-8f9c-b4945547157f", "comment": "Malware payload (AgentTesla)", "value": "a814bfa072d7c44967263f5c7991bc97231b537ed4917dd3f14e50e60bd04b253e81ab758fb6a78c3b6e005684907157", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629102914, "uuid": "dc80d22b-ec72-4e34-bbfe-8e9e4464e82c", "value": "T1D1158CFD7540B99FD53BC936C4680E15E26068A3E2CBC617E08335998D7D3A69E012BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629102914, "uuid": "8f99d9aa-8dd7-456d-96f4-158100b7be03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629102914, "uuid": "43d2d08c-bf3e-4af6-91c1-aa3fd8c9a7f5", "value": "12288:2H/ZuIhoMC40mobgRQNh4gUW9P8zBjcKs+O8eN2oYRcKdiYdcu5HGAXglXH/X6mo:kxujMUCgV/QO8GYCGG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629102914, "uuid": "252386be-1c28-49ba-8d41-9f232c7a38b8", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629102914, "uuid": "001242c4-b956-46f9-abe1-fc3b8a7c8a37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629102914, "uuid": "911c61f2-936e-4d5a-8192-c7e27d8c591d", "value": "QTS TECHNICAL SERVICES CO., LTD SOA AS AT 31 Jul 2021 - USD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738f488f-fed5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629147828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629147828, "uuid": "4ba26003-115a-4509-a086-1650bde459af", "comment": "Malware payload (Dridex)", "value": "725d90f85f15a488d9cbf9eb2f81585c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629147828, "uuid": "4357b1b2-898d-4c76-9e09-e863282b24c0", "comment": "Malware payload (Dridex)", "value": "7c927ba1fcda33da30b47aed10a4d3b1ab4dcf5c157acc5ca6e90985a70b1eb1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629147828, "uuid": "438f853e-1479-437a-afa9-d99261d8483d", "comment": "Malware payload (Dridex)", "value": "0b3296b834cf3acbd4e8a1c83ae7abf545e62ec6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629147828, "uuid": "eb201fe6-3e07-470a-b054-f43a38e2dafc", "comment": "Malware payload (Dridex)", "value": "36b0608ea885a0130d5eb9372cd43bf04f29d71baae9ae212c7cdb75c9f202ebfdb3d38cd31e9e96d89638414d779862", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629147828, "uuid": "b6d33797-f0d0-42f7-879c-7ffebd4c2b39", "value": "T18954021B9573E261EA8B603E4C9A1FEF53759A7F29D177629BE3A40C6E08CD620500C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629147828, "uuid": "2a939a41-b725-4552-b1f3-1e6a8bc5bdcb", "value": "6144:SXNSLcq+YXEst99kP9pQ8+h+IHbhPmq2vVilgNwmeW:4PYXEspkw8+0IHqvVwgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629147828, "uuid": "ca693264-d58d-4865-b653-07ac31d70c19", "value": 287387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629147828, "uuid": "28127c51-5955-49c7-ae46-45109d30e12f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629147828, "uuid": "62261389-0202-4365-8090-d7e6568ecc1d", "value": "taxve_158762_20210816_581617912_0748186.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b840e33a-fec0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629138924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138924, "uuid": "69cee137-a137-4b0a-b7e8-e2b729bb2170", "comment": "Malware payload (Dridex)", "value": "533b4630cf5f95be1aae17d23f93eecc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138924, "uuid": "776ba533-c2d2-4653-aa87-fd0c186d81ac", "comment": "Malware payload (Dridex)", "value": "7df32ebcbcf64f1ec3854cea7cd33af47aa721d7a1e099ddacd09d5f169a6b22", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138924, "uuid": "63f0be58-6dec-465b-a500-4e87fe2baee4", "comment": "Malware payload (Dridex)", "value": "4ffe04df25200f95c6a26c0435c236d201c90a51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138924, "uuid": "ba304b3a-6fc4-41d4-8a52-90d8c1568859", "comment": "Malware payload (Dridex)", "value": "2637a2e5f4e6922c606c8fb0bd3740001b224ec50f4847e8b2487cc1672e7b55835783e3e4de28cff47a762c4607a709", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138924, "uuid": "1b36c266-f9e7-480c-87f1-c5dfc17a1d13", "value": "T1BD440140195BD50CFEDFBD7D9CCE14B4AF888DAE1540696F20F0EAACEBE03925D1509A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138924, "uuid": "01c34357-f34b-4aac-8ddf-36e6ca49325d", "value": "6144:SAtZbAPPimNA/kjoitkinEVsWVEOCOv8pVrsuSVbbIEMB:VtZbAPDNAcMSnEVfSbOUpVouSoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629138924, "uuid": "ffba3bb3-c41e-451d-9f99-2c2237337277", "value": 264284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629138924, "uuid": "a51c52fa-308e-4954-aaf6-7dbf30602e5a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138924, "uuid": "a100b6fd-373d-4b6a-b740-4a832780f2d5", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_8_35495.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ec2e25-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629104793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104793, "uuid": "302595c5-5764-4171-bef6-7d1bb038408c", "comment": "Malware payload", "value": "e4dc512cdbf6dbdd107014d399b61c83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104793, "uuid": "1fd0f30e-e1d8-43aa-95d1-ccecaac5fb38", "comment": "Malware payload", "value": "7e9c5763bf74c892d2d38458972eaf91efce287b15719501c8d249c3e3634b24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104793, "uuid": "6a7313bc-fcce-4365-b897-4f445d35db49", "comment": "Malware payload", "value": "ca501eeffdd69fa7cae571ffc2c5acbc249fcf5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104793, "uuid": "7ffa0652-18ee-4597-871d-46c3b332c029", "comment": "Malware payload", "value": "cb1f993bc1f309adbd4a2a1f3fd7398f464530fc14293b32b31e45e31809d8495935e23088c06771a8da45e44e57d307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104793, "uuid": "8539dc85-62e4-4a73-aac7-eeb4f4bfac38", "value": "T1D5547C59B2A40CF9E877813DCC525546E772B8160370DBAF07A0466B2F276E09E3FB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104793, "uuid": "06b15950-996a-4627-8e8e-efaf7ca73278", "value": "a9d801fe65ff443cc82a212a38e66d33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104793, "uuid": "a33eb2d3-699c-4015-bc13-e38a8884db94", "value": "6144:EFdC7yr9jRY1wAtVLTDdRrzJXtohrx4orTZkkg:i9mwkVLZtoRJkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104793, "uuid": "53906ed0-ae27-4fc2-af6b-a31775d0c703", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104793, "uuid": "26679fc2-4031-465b-ad91-242c5c2cf131", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104793, "uuid": "70773c88-3f90-4d2e-b420-0575ab05a7dc", "value": "7e9c5763bf74c892d2d38458972eaf91efce287b15719501c8d249c3e3634b24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b34586-fe60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629097639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097639, "uuid": "d7bc30fb-5013-4305-beaa-0ceced4a4411", "comment": "Malware payload (RedLineStealer)", "value": "b73776df4ad9e9763950e26d35f35311", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097639, "uuid": "67c3b31d-f954-4716-964d-4bf2ecd8bbe7", "comment": "Malware payload (RedLineStealer)", "value": "7f2a345bac20e6bef244708829b3eafd5ca634911f42fa7d4be7a160bac90ca8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097639, "uuid": "293366ea-9704-454a-af36-b9950c9ce171", "comment": "Malware payload (RedLineStealer)", "value": "d4f5e529d10aa92d3419058a99d01bc24ea5778e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097639, "uuid": "d909cf6b-3112-4ecc-bc71-009e1ab4c66d", "comment": "Malware payload (RedLineStealer)", "value": "2d8abad4c4b1f0bc70a3cd2861dfb3b462fcdc1ad7e2ed14677590adba7d05051e78fdc5eec65d352a06c34cb4f6fc11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097639, "uuid": "85f679c0-5b37-4c59-8f8c-adf1f8a5ecad", "value": "T1FA2523137CD981B9D4DC03B67A84662491F8DBEA4771858337684A070FAA3C7D93FB89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097639, "uuid": "193e44b3-8e8f-4853-aca1-498bad6ef535", "value": "667e6d0f434d248524103ade13b913e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097639, "uuid": "8d23caed-0132-4a69-9ab1-82dcfc6c9520", "value": "24576:mSLXbfX+nr6UHsBldW7BA9AtS8dElkgrK2E2zGltazFUxg:Vr+nenRW9A9AtOlre2zCtOUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629097639, "uuid": "6f98eb99-54ec-45d3-9618-b8a06e362aea", "value": 978199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629097639, "uuid": "b061776f-e119-48c9-9fa7-807968a7fb8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097639, "uuid": "b965a6a3-7649-44ff-b00d-14c71b8553a8", "value": "b73776df4ad9e9763950e26d35f35311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8bfc2a-feb4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Poullight)", "timestamp": 1629133532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133532, "uuid": "410127d4-a28c-4741-b2f2-f503abcc1a17", "comment": "Malware payload (Poullight)", "value": "5ba895fb23729ffbb001e5dfe74aa132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133532, "uuid": "dad82891-a5dd-4474-a1f7-9b98fd740063", "comment": "Malware payload (Poullight)", "value": "7fc66f244e022341520c4af91172ec3833c36b95624ee5c510086cd8d71db7ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133532, "uuid": "a95c7f4c-5b78-4c08-8fa4-2955467097e7", "comment": "Malware payload (Poullight)", "value": "7a2b094329f369ff5a67971c3a71c46775e93000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133532, "uuid": "16efe035-ba06-4403-b239-2a4e0960cb5a", "comment": "Malware payload (Poullight)", "value": "472fd6f6d100075287a3f2b7355ba310d3db25461df895e2280d321383e5a6913651b306ef5e65deab431ab6343e60e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133532, "uuid": "a451dbce-487f-437d-89da-c032f7024acd", "value": "T1D1B45181E589ED9AC53F22F2F87DE91019199F4FA274453A2B257A1564F338370AFC0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133532, "uuid": "1bbad65a-493e-430c-b794-202d5c253eae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133532, "uuid": "0438e586-b5ff-4132-9760-db9c86aa4cfc", "value": "6144:+nWE9iozOsxqki5B9uuQK3fgG0O+hWQdeq4J+jJ4nD:9oNqk4Luu8t4aA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133532, "uuid": "faff4778-c826-440f-9f8a-2f6b0de44d35", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133532, "uuid": "3c62475f-ef68-4e54-b8b6-fb7182ec5da0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133532, "uuid": "f5fc9792-bffe-4fec-aac3-b1c819655b1e", "value": "eufive_20210816-144801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122c1262-fed7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629148524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148524, "uuid": "a6d5bbe3-8cfd-46bd-92cc-23579096da39", "comment": "Malware payload (Loki)", "value": "4b01a39cd776e37085f1a17b137ca4bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148524, "uuid": "e4dd184f-e7ee-4056-b949-1ba46cd06877", "comment": "Malware payload (Loki)", "value": "80a9961437f24731f3430adc1f1bc3fe0cad24eb3ec5a547f5daf4457fc0dc0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148524, "uuid": "1293609c-0e49-43ce-8b88-91f57fdba334", "comment": "Malware payload (Loki)", "value": "8f576c2adc542a06351fc18b6326d5ce1aedb5cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148524, "uuid": "af935a78-0671-46ae-b1e9-0fb73fbb6870", "comment": "Malware payload (Loki)", "value": "a6cb369c5199b84d18860fae7422e8142c7ad4baab90aefc65fba45f73717d6c517b5651d0099daf3cef270ba9f0b7d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148524, "uuid": "b48b790e-e4aa-4c31-aa25-60e72bceb9d2", "value": "T1F9D44ABC3150B59FD13BCD36C4580E55F660A8A7A3CBC613E0932949993D3AB9E442BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148524, "uuid": "93b19dea-50ae-43f2-8008-e33ecc00b0ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148524, "uuid": "23e6ac37-4146-4cb2-b651-d3a0437955b8", "value": "12288:6O+bb6qs6ej2QjBymYxNBOPmbqS3yGOMJ4x8EvieR3J8kJW9YUY26finjgwLl4f7:6F1EjP15kDQQ3ycEZ9fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629148524, "uuid": "e2c7e4bc-d99a-4077-9afc-84d898b467d1", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629148524, "uuid": "fca8f8c7-5e44-471a-8861-a40d80bc02c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148524, "uuid": "60ce214a-26f4-4de5-8cc7-ccc23b019a9d", "value": "I1bdnNRCIAamjyB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22eb94c5-fe6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629103455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103455, "uuid": "61214edd-3095-448d-9baf-472db90284d5", "comment": "Malware payload (Loki)", "value": "c0cfbf27ea18763fdeeb82404904af23", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103455, "uuid": "2db56035-2e6d-40f5-882c-a9a3f9d10bb3", "comment": "Malware payload (Loki)", "value": "8210cd364c09b5b7665d75a29ec56177dadd124e374db975a09d3e85253b4ce8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103455, "uuid": "5ebc811b-501d-4ca7-83e1-bc4b40ff631b", "comment": "Malware payload (Loki)", "value": "627b70f25b9f9ba5cacf1a1175c7e05afb3ee2a2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103455, "uuid": "0de86b7f-0886-419d-9596-1126898e58aa", "comment": "Malware payload (Loki)", "value": "6f13c239faf7f3739d1857a9340e42e26291cbc0322bbf5ae231a0e4ca35ebce9fe3429afcfcb68aa09add78442d7292", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103455, "uuid": "a29792d1-d846-4713-b129-11176d92f507", "value": "T16F551275FA8B697AFA019C3A1B1DF2F4469F1F6012896810E1843339533617FA385F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103455, "uuid": "c027904b-210c-4071-a9f4-5711d67c0ded", "value": "24576:r7B5sxUnw1JEWlyOeZdfjvxtQtO7ikQ5giy+oLu15kXUc:r7BmxWwMGUdd5nQ5gR415O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629103455, "uuid": "0000c91e-282f-4c75-95ca-3da12a87ef5b", "value": 1369624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629103455, "uuid": "3910602f-29f4-4762-a28e-dbc2554b558b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103455, "uuid": "7d49f0c5-f4c1-4999-803a-279330c02cce", "value": "Payment Advice 2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89adb6c-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629126040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126040, "uuid": "45c1db93-fef9-401f-8399-67ab216f6612", "comment": "Malware payload (Loki)", "value": "686bcaa21a34733719f1fdb14dbcb639", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126040, "uuid": "8493d6be-25f4-467e-b6d5-efce3e9e7914", "comment": "Malware payload (Loki)", "value": "82e12573052c2f4088b79873bc969a0b0262d2beced743b68282248c3dc42ff7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126040, "uuid": "db4f0da0-6246-477c-aec2-c9ef168c8985", "comment": "Malware payload (Loki)", "value": "66f063971466ec7d971ace5493d83f6e80128874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126040, "uuid": "f528c1e0-2d38-4218-84ff-d9e7fd538f3c", "comment": "Malware payload (Loki)", "value": "d1782d2be41a7e4e9e2594a6103d45f3db1c1ee93f6bdb7cad817e2b84b12e51b7976c71fa54326a900b9df535e08ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126040, "uuid": "ab66128c-53c1-4386-a34f-f283ff115bcf", "value": "T1E0C4CF11B9C1C032DA73383147B0D1B14D7DB9312F2696DB63D819BA9F64AC1A936B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126040, "uuid": "986e6aee-6567-4065-ac5e-7af0296c6c05", "value": "82004e82653b7bafbfcf73a18d8cef95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126040, "uuid": "ad9b1238-db80-42e5-995e-dc645412d78a", "value": "12288:M3RwHX34JgXZrXhcepr1klgTszv1P9V594uFs1zReedXIiExcUVq:M3Rmcepp9TsTh9Vme46Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126040, "uuid": "f3d7b476-0061-41c2-862b-f762217d6c8f", "value": 569715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126040, "uuid": "432ba677-4e86-418b-b510-a472ff20b64a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126040, "uuid": "8e7bcf16-f290-41ba-8699-c45d5d579edf", "value": "DHL Original Shipping Document 4722823719_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8b1a9f-fecd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629144249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144249, "uuid": "e1c5adc7-c830-4101-80b8-218540f16844", "comment": "Malware payload (Dridex)", "value": "3333b5028893e1fc6fb205abbe3a4cf2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144249, "uuid": "76033269-a496-49a8-9c4d-d900abb9480e", "comment": "Malware payload (Dridex)", "value": "82e713f071d7492e1958a7a58834b16109f47599dd7058e5e1825ec6103f84d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144249, "uuid": "f7fc5f72-4147-4fac-a728-dedfcc315505", "comment": "Malware payload (Dridex)", "value": "e31825ddc733d4684d9d3ad4dad7ea382424be35", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144249, "uuid": "e706ddac-a765-443a-9abc-34b7ccd8f289", "comment": "Malware payload (Dridex)", "value": "ce110fe36c6fa622087ac5a201079bbecdca40add03d2102a13e194a3607dc591d63a0e2e183b91e1354091de9dbbd1b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144249, "uuid": "bda75fa2-efe9-42c3-a754-9bbcec44e39f", "value": "T12564029A2537E45CFF8FAE7A5CEE24752FC8C9BE0540392F31E0A61CE6C02D65C55292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144249, "uuid": "b5e3082c-2a6a-44b1-8152-37188f892a64", "value": "6144:SktZbAPPimNA/kjoitkvomB3Hg7w2gV5oknHU3UCdsHjlS99bIjTE:BtZbAPDNAcMfvBQs2gfRHWElg9bIjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629144249, "uuid": "d2924123-1498-4478-8e37-c4a073064878", "value": 325002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629144249, "uuid": "01426606-1177-4b85-ae64-9b1e41789678", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144249, "uuid": "9c190159-1e35-4cfe-b554-9e44973481c8", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_7_5215124485.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43c0649-fe9f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629124851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124851, "uuid": "40955dc5-e04d-4c7c-a4a9-105028ea7c7a", "comment": "Malware payload (Loki)", "value": "1da360c9799bcbc1707c704ce5336919", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124851, "uuid": "6ebb7364-295b-4644-a964-802f7f47f64b", "comment": "Malware payload (Loki)", "value": "830f74bfd54c88a3f3959a2b9a22f71f7fa85986137687184f993ddbe02433ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124851, "uuid": "44263164-acad-4bd5-ba81-1b521306019e", "comment": "Malware payload (Loki)", "value": "8a8e1eb35a87561821ef69c85e472b4cfa9e94d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124851, "uuid": "45dacd1f-2e0d-4f1f-a379-7bdf029906b1", "comment": "Malware payload (Loki)", "value": "9a319fce88240cb1ed2ac3d9d54f20eff9c310d92bc77b6c43624b0a1086816ff7b3a4017f2da5e7596e5d8c586bb71e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124851, "uuid": "11574a16-a218-49d4-8e19-0346aba7672b", "value": "T10035D73915B82B67E079E325EAE45417B3E0985FB225ED58BCCE03A70216F4265D333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124851, "uuid": "bc23d109-0685-4965-8418-b8243462cc3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124851, "uuid": "32492823-0b6c-4552-b22b-ea1eaab4f509", "value": "24576:n4XwyKBFYtblhBjcuDMgdqat3hINPd+O:4Xsyd1Ac4a1Q4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629124851, "uuid": "9058939f-aa93-4d9c-b2bb-413449f04b6c", "value": 1142272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629124851, "uuid": "1f3b0be0-57a5-4908-b1ca-db12fc76b414", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124851, "uuid": "10b0a372-a1cb-4974-b4dc-f0ec61f13554", "value": "DHL Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a96493-fe5d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629096503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096503, "uuid": "440580ff-65ad-4ffb-842e-bdcc2ca711e6", "comment": "Malware payload (CobaltStrike)", "value": "a028079c891c15c18383f65b2b1aee80", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096503, "uuid": "ee53d29e-96b2-48cd-ac77-5d08af555e95", "comment": "Malware payload (CobaltStrike)", "value": "8344424b2ab65b90171d02df7f9f8625308284c4b25e0e489c005f9c164784c2", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096503, "uuid": "261f6107-7195-46af-87f4-24a4ec8999b0", "comment": "Malware payload (CobaltStrike)", "value": "1a04df05df854c5b77d740c1831eea7f967bf62c", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096503, "uuid": "5b1c99a4-37f3-48b1-abe0-31923652bfed", "comment": "Malware payload (CobaltStrike)", "value": "598553607f2372eb5beac603009b8333e79ea5f4d3aefc0d0bcc54773693f0f400d2c5e4370da8a48f57d3e4bb0addfd", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096503, "uuid": "dfa0819e-6206-4f3b-b7cc-4dffe907c523", "value": "T10E4612FD6248371CC42AC8709533BD4AE2F2911D1DF5DA7A7AD77AC07BAB810E502B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096503, "uuid": "f21f133d-c14e-4273-aeff-218b5580d0cd", "value": "57b04b22145eeb8eb60d5d0a981e9a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096503, "uuid": "74cd5239-0779-4994-8302-15cf22998381", "value": "98304:TCQHgT04/bQTFX5z/KicwswzwYAJbcHRrszaf6uM7lqs6GkNwWDtQAZr4c:zHgBMLAwswzdxr76uM7D6GGwWDtLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629096503, "uuid": "c37dadd2-59ac-4150-9381-2ed072631422", "value": 5657088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629096503, "uuid": "61eaa691-cf34-429f-a433-3b34b3f269a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096503, "uuid": "837c47e5-636a-4c62-a92c-ca53ae016a31", "value": "a028079c891c15c18383f65b2b1aee80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6296a942-feba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629136203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136203, "uuid": "aaae3eb3-cbc1-409c-bb06-902d7ff19236", "comment": "Malware payload (Mirai)", "value": "36d581a2cf5daee6168fb2ef1dd9d200", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136203, "uuid": "eb87522f-8bd3-480c-bfb9-512372161186", "comment": "Malware payload (Mirai)", "value": "84302b12fb4ac13a8cd72ea6b93582cdcaba3f83bd94483af19bc1ce447aa8b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136203, "uuid": "8e3e497d-e1c1-4817-a9ac-8932b078f7f2", "comment": "Malware payload (Mirai)", "value": "b47e5e1c191bb86bd77c774451add75e89f517bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136203, "uuid": "2a54c08a-4a0c-46fc-ba1c-31bf73f13933", "comment": "Malware payload (Mirai)", "value": "ad7fad1783cdb1ca4d97f29a8b7f866b1afbac0f2689b5a5faca6e34165b8057f9551d57891d98ac319568eb7c635dbd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136203, "uuid": "02e69a20-a0ef-4673-bc97-c16b40c7ec3e", "value": "T13062D04E31E1445FFCF1A27B5726A84EE630E6ACCE2D68045E68A7DB3779076335002B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136203, "uuid": "564ff9ca-7ffd-4881-89dd-5930a536c2b3", "value": "384:MdomuKpwPpqUDcvSIX0sAzSpPnlClWRhCla2WkWiHKG/:sFwUU4vF0ByPn8lxDW4KC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629136203, "uuid": "14c3df44-fca2-4631-814d-1ac602282c49", "value": 15568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629136203, "uuid": "b2d66e1c-083a-4317-bc0e-ee3595edb9f3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136203, "uuid": "b2d1f625-c8dd-46da-a3c6-2a80cae51a1d", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7855a6b-fea1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629125608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125608, "uuid": "1f139bd7-a155-4bb6-a82e-1cb8a5523c01", "comment": "Malware payload (Dridex)", "value": "b0f65a63dd08f3977dc1bedaf30aaec5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125608, "uuid": "ae3aa42c-1fda-4f5d-b735-1c912adc44ea", "comment": "Malware payload (Dridex)", "value": "84335aac46b5b746dbcace6e04e4d3af2e7f7bda72da361a6777091ad9dfc09f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125608, "uuid": "db11fa0b-1b2d-4f72-b89d-32d233f4973e", "comment": "Malware payload (Dridex)", "value": "1d9428fe595de912eb087a568144a2e5e90fb545", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125608, "uuid": "18f5669d-f94d-4f22-84cc-475d0976327b", "comment": "Malware payload (Dridex)", "value": "2aea60b0583c4eaf5eaff2e8552969c4a75f65eac3c0d2515d0a554019020bb30c62646acccd2ed07b3c75768b9b0505", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125608, "uuid": "b4cea979-ac10-4c6c-ae7d-712cd9841c9c", "value": "T13C04E18CE48B6107E5276678431CFB2614C4AD5C56F2CB5CAA41C27EF0B7E3994B0B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125608, "uuid": "0cce1bc1-75e3-42ca-9bed-ce5055c5d302", "value": "07a08e3e316eca8e37df205ff5246906", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125608, "uuid": "f27a424e-3486-41fc-af24-6caa0d2e5da0", "value": "3072:nqJs2vTNBtg6SSiP2uPGub071f8eWdwBIZ2qSeOVg2f0LhSLl8Vaci2+e2f2:nqbNfaScP47aeWdWqgj0LI86b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125608, "uuid": "9fba6486-6616-49b0-8746-e91d13b1a285", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125608, "uuid": "202ac2a6-ff01-4fcc-ad0d-06c042f74941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125608, "uuid": "b7c20df3-b517-4027-9c25-e4cc8373fe80", "value": "b0f65a63dd08f3977dc1bedaf30aaec5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9d4773-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629104840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104840, "uuid": "7355e977-8eb9-4e2e-b585-d1ace17cc948", "comment": "Malware payload", "value": "2d2955e9eec8a5c1c233f9b3c3892fc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104840, "uuid": "3d30d047-34cd-4ab1-a28e-fef4426711f3", "comment": "Malware payload", "value": "88522397129ffb1ec2536f0bbc03d50d2d0f2a6447fa345153e088b6f99ba676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104840, "uuid": "a2abe492-74fe-4b41-bffb-e729df85de0b", "comment": "Malware payload", "value": "2256383c24a9e5c74e6dece140f2f567d51e5668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104840, "uuid": "a378f778-9f72-455c-ac4d-b07ce90bd66d", "comment": "Malware payload", "value": "905a4cdebd180612d7a1200d3a04ad2a02f1f8a2e01d86d087954496e29bf522e1a6f3e6f00e6b9da451f04b1d6506fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104840, "uuid": "6b3c81a4-9304-4ff2-863f-8b458edce6c0", "value": "T1B7547C59B3A408F9E973823DCC525906E672BC165371C7AF07A0466B2F276E09E3F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104840, "uuid": "abe9946b-27a6-404c-9f6d-a6c5aff130bc", "value": "a9d801fe65ff443cc82a212a38e66d33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104840, "uuid": "71a15633-51bf-4b4e-a4b8-fd3025fcc46e", "value": "3072:pjQQBNZ2KhcHKA7TJ8iR5pCFfT+LGv5isJqpDq6Y0G5oY46AoSN/KLbDkmyU5X:9nb1hHABn5pCdT+iypeZohrxSb8cX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104840, "uuid": "77d998dc-7e94-4f13-8b7f-624cccc0c1a0", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104840, "uuid": "f352972a-2470-484b-ba66-d9430cf8c9b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104840, "uuid": "a3aab730-88aa-40b1-a4d7-da657b59a900", "value": "88522397129ffb1ec2536f0bbc03d50d2d0f2a6447fa345153e088b6f99ba676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297cfffc-feb7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629134819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134819, "uuid": "cac6e25d-c062-41c3-a9ee-3f2748402c22", "comment": "Malware payload (Formbook)", "value": "84b8eeb0b9ec48f9039710dcbf5c7d6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134819, "uuid": "e5ee5062-710b-4441-b4dd-9f061c76f153", "comment": "Malware payload (Formbook)", "value": "88965fe324fadc62b6a3d21b17180c65ddd2fb8b4fb0d021f358979a3a393e68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134819, "uuid": "44f53960-8d9f-4c03-b907-3ec3c55e53d2", "comment": "Malware payload (Formbook)", "value": "6539b3e8db3e50cb8693179efb4af75d2076604a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134819, "uuid": "623cd99f-eb8b-46f4-8017-594e131c0437", "comment": "Malware payload (Formbook)", "value": "6150155a48ddb91043c8556d614c16813007eea088d74d22441a236e26116d1ce103710fea8af4c89ed29454b71f4811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134819, "uuid": "3aae7769-211e-420c-8a09-d7d550a76ec0", "value": "T15CF408DAAD888EC0D5B2F2F0E40A866207A41C55E88C46CC4DF97DBE45754ABED1B03F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134819, "uuid": "21422775-b54f-4cb3-b5c3-05c17f4eae4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134819, "uuid": "bc01bcbf-3546-408e-aec9-e428d207a99f", "value": "6144:iqERUNe9bwYLPHOkyk4r3G/I9Hr6YC5m+0Yp3TqABYhMSBhp/T5my9SzA0o6y2/:SIe9zZeXCQCCplm0SM0o6y2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134819, "uuid": "9eec23bd-39f7-459a-9f43-8bdaa415a479", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134819, "uuid": "f852af3e-b746-475d-9771-52075d38d5ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134819, "uuid": "a14bc7ca-7db1-4fdd-b070-3c3fc45b2527", "value": "7,800,230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76aa8ec4-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629104884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104884, "uuid": "0354ebce-b112-468e-b306-d55a9f542f9c", "comment": "Malware payload (RedLineStealer)", "value": "48f94a392f4f2ebc15bc96411bee50e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104884, "uuid": "5c6612b8-72c9-4f48-959d-90324b113de5", "comment": "Malware payload (RedLineStealer)", "value": "88ff40bd93793556764e79cbf7606d4448e935ad5ba53eb9ee6849550d4cba7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104884, "uuid": "5a75fab3-4dcf-442d-baa6-1eb4032ebe96", "comment": "Malware payload (RedLineStealer)", "value": "c8430511d6b6cd1be3844de4fcf6db07fbf2e16e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104884, "uuid": "e07c4865-a02b-4ecb-83d5-96561c3986aa", "comment": "Malware payload (RedLineStealer)", "value": "65a76473df326462cf188d00b09139d3ef92f589c4f976425349948f740239f7ed157fa11642f832a5983507bbb64f70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104884, "uuid": "abb32657-9b14-42de-8f03-40c7f44eb144", "value": "T18454E02DB49FC8B3C35630750473CBAC8A69AF10D69305BB17552B2F5E34FB1962A31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104884, "uuid": "085e2b0b-c68c-447b-8436-572ce5741e64", "value": "b6eb307a53194f1a2629d22afffc5564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104884, "uuid": "e5e44dc0-fff4-4c97-a319-9cdbf1c48574", "value": "3072:BjbeJL8zV5Ag70ZDVCnYYB2pWb/NyH6Fwmul9J+wgG1vf48khNsFCLjBND9Rjc/j:poLCZ70ZYnt/I8fwgG1oJRc/mSEoc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104884, "uuid": "02fc8930-7d9a-441c-bdee-e50e07f25799", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104884, "uuid": "ac71ddd4-9570-4a1c-a31d-c764e460732b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104884, "uuid": "4b21b7cd-2db7-4385-b04c-a0d8fdcef0c5", "value": "48f94a392f4f2ebc15bc96411bee50e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d42ca5e-feb9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629135684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135684, "uuid": "d35a8cab-4a5f-44ea-a12a-4ea1226c7bb5", "comment": "Malware payload (AgentTesla)", "value": "37a5f6cc78f098591dd05bf7dccbdcc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135684, "uuid": "87ef2b08-fce8-4770-a54c-2faface58e47", "comment": "Malware payload (AgentTesla)", "value": "8919a66dbb5bfc6f51c3ecbc60adfe3424579e57bc83a632c5d00fd616778bd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135684, "uuid": "9299c2cf-04e1-4346-9acd-b40449df08e7", "comment": "Malware payload (AgentTesla)", "value": "4775fee9520e0ffc5f683f45e79b45628fb25500", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135684, "uuid": "d7ac9154-1711-42c0-91f9-003bd83b7c25", "comment": "Malware payload (AgentTesla)", "value": "58ca115214a841bf061bf1ee9298b4178bbbbed3696c91cfa44d0859a86b48d14ee69f5f086dbc954962f5a6a39c20c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135684, "uuid": "1e001b31-0ac5-4914-abfb-8783b5168fa7", "value": "T18545D63A15B82B67E079E329E6F44417B3E0945FB225ED59BCDA03A70206F4265C733E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135684, "uuid": "6c24667c-2561-446b-a66f-0604d82eef3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135684, "uuid": "f93b0dde-2e77-4183-9c43-af64bb1fcb85", "value": "24576:Ne/+FYVblhBywk3HVUMNi/nBSdN1fbCeAT/QYFI:nyF15p4xmtT/QYFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629135684, "uuid": "168c4588-5ed3-46e1-9225-72b72f06e108", "value": 1193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629135684, "uuid": "562d6d14-a2bf-4dc4-bcac-779f3772fa01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135684, "uuid": "d26ba430-8283-4ccb-9ffc-69b54dda0c81", "value": "37a5f6cc78f098591dd05bf7dccbdcc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c1ca18-fedc-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629151029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151029, "uuid": "3332058c-a135-4f21-86e6-f007799e8cf1", "comment": "Malware payload", "value": "6fc52358b0e882de1fb890076f83172f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151029, "uuid": "99cae000-2357-4d2c-8679-7ba80f17cc1b", "comment": "Malware payload", "value": "8980c8abaa3365782c905b3f9506a032c54a5d1833fef1fe0ce46b6f84ee7534", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151029, "uuid": "31bf70f7-a450-4c3c-8ff4-9d94225d61d7", "comment": "Malware payload", "value": "00fd67d3a87d10c0f8787cd580572c4cd1a7aaa8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151029, "uuid": "0a7c896e-ef86-44ca-8c30-5d4abd7235ba", "comment": "Malware payload", "value": "eddca42827f905c56e962f945d6e6eaa304bd5c5a47e560348fbff5f5477c0b4830db7d9b8954d766d97470af6373e3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151029, "uuid": "55f9370b-d045-4b44-b276-2ca6adba4136", "value": "T16C2633017482D975C11216775281B7F8F707FF16D4B907838AA3BE6317A13E8DAEA349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151029, "uuid": "cb20a1e5-fcdc-4cf9-b64c-6ee164acc0e8", "value": "477c037bd85187d535326c948fa8e5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151029, "uuid": "97f64bad-3d23-4384-8458-9628e5362047", "value": "98304:vnGiqTWRDnHhCwJsgkfTryDBzpf8pK5EQgotfPM7TkOtOZAK:rqTEH8wJsJTWVp0pVpIfUIAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629151029, "uuid": "e77e38c1-3780-45b3-bd1f-6e4bdefc1bc2", "value": 4602408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629151029, "uuid": "d0308d82-191e-4cfe-9a53-3636bbb23767", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151029, "uuid": "ae0c88c4-5347-4fde-ae99-6aa9f9fe98fa", "value": "6fc52358b0e882de1fb890076f83172f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3034d02-fe53-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629092100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629092100, "uuid": "fdbe5d7f-edef-4a9b-a631-aea4bf0ae79d", "comment": "Malware payload (Formbook)", "value": "d98f49c17101f5715e07e876585f6e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629092100, "uuid": "1b042810-0767-416e-abfb-3e4004c9f70b", "comment": "Malware payload (Formbook)", "value": "898e39ebe6bdfed0d216a54673ae93fe5349b1addd89e2891b969ff3745536f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629092100, "uuid": "0c2a6eb3-16d8-442a-8209-bad5627d12ee", "comment": "Malware payload (Formbook)", "value": "af67b2295f7cf496dd93be883bbd39b3e33a8360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629092100, "uuid": "dbd4658e-9b2e-4c97-8e9c-999d427bcf94", "comment": "Malware payload (Formbook)", "value": "32dfc0480cefa119530ead76be0d909bb8e4182b29cfd52ae6c01761e1e57f0916fb3bb0705b0e0b5275a9924e4570ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629092100, "uuid": "f1b94b4e-10fc-4299-940a-bbb502dc398a", "value": "T19935A13D29B9162BC1B5D37ACBE59813B0149CAF3414BDA594D673660333A87B9C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629092100, "uuid": "16fa891f-0508-4356-b025-9049f612e6ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629092100, "uuid": "be5af2e2-e77b-40f9-8105-87c0190efefb", "value": "12288:ZGAxqujfAPRyY983gp3KJsUAywxcB9BLbF6UKqhRXLWZrf97tXk0V+A:VqujfAPR3sA6J0yCC9hbXKabWZrTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629092100, "uuid": "8a2655f5-2456-4b2e-91de-e22126e1e403", "value": 1090048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629092100, "uuid": "f1932e79-d542-40ed-94f8-5d0c846c7abe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629092100, "uuid": "802435bb-82a2-411f-afc6-72c792ff65c7", "value": "New order-enquiry108042021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43016919-fe5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629096636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096636, "uuid": "e1bfe546-392f-45df-b349-3f6a6cdb9a91", "comment": "Malware payload (AsyncRAT)", "value": "949576a0beb43c7d197389d4a572006b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096636, "uuid": "395ffad8-e2a6-4690-8fd0-568da9d20199", "comment": "Malware payload (AsyncRAT)", "value": "8b7c8b471a0f5e45026d07fabae3eb68f7251d066830cd68e7cf5a7fd342e13b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096636, "uuid": "1a055e50-247a-41db-8307-b8f7b0e9e22b", "comment": "Malware payload (AsyncRAT)", "value": "3870cccc225cf9d5d492f56e5661197990fbf439", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629096636, "uuid": "551600d2-7da0-4caa-b889-5b98ddecf9cf", "comment": "Malware payload (AsyncRAT)", "value": "7d827611f42df2630e4fca736cd1d0c723301031407ef35445d38a58d51bcad49df3d26bb8cdcacba0f341480823aee3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096636, "uuid": "886a35fe-b401-45f0-bcc0-77bdb25eb0af", "value": "T1C5E4BF7071A78A96F51F4AB42578BC5403B231F3E9C69939171A614ACFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096636, "uuid": "765f21e6-bb02-4cfd-aafc-514b1c0a7898", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096636, "uuid": "c5456e70-8d66-4e55-b79d-20f2b03c0c5e", "value": "12288:jJZFMKPw4+FAWeiq/ZHTWL7ewKVBd3Y2OU5JOEPpBja:VG4+FALZeSVBVY2XHPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629096636, "uuid": "cff6c454-d8e8-4867-bc97-d729e06ff745", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629096636, "uuid": "ba35469e-5bea-4f3e-b881-2452c30e1a00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629096636, "uuid": "ef6007e3-b22f-4d22-9aa8-cb314e49901f", "value": "Sathya Raj-Resume.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43420b85-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629125843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125843, "uuid": "d401223b-7b65-46b0-8199-bd6c76b781c0", "comment": "Malware payload (AgentTesla)", "value": "d069a851e465f12753815fbed9c8d196", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125843, "uuid": "2765b87a-8b57-4851-b34a-d3b5b75bc87b", "comment": "Malware payload (AgentTesla)", "value": "8bfb1e565f813a31d18d712fb9a19332d5402cca73849ac803794120e0c383e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125843, "uuid": "5284c6fc-9352-45ba-b162-1c568597d2e7", "comment": "Malware payload (AgentTesla)", "value": "e370bcfa3f3c1426acf8398ad4ed2667c328801f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125843, "uuid": "401b26ca-5ba7-490a-8725-2afff066ae63", "comment": "Malware payload (AgentTesla)", "value": "2c63c36b86c01c5478c0b375dea3592f5a262b2fb83a6b55fd6f858a6c6f18b7cf1a88c730326e87aac5620c51120174", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125843, "uuid": "a52db77a-57cf-40e7-b17d-bd6b0f876521", "value": "T134F4CF29BF848D48F2B30E36CC9E50109EB9EC235B47DA3F60E07629587A759D63325D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125843, "uuid": "9e181631-5253-4617-80a0-52d222bffa1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125843, "uuid": "3829faa8-c7d1-4fef-b281-193c59fc938e", "value": "12288:OfOb3M2g2VAuZHK7zmHg7MVaKK27aequD3jqsE+:Ocg2BUiHgASqdTqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125843, "uuid": "c875e797-d81e-4d79-a3b3-64db63a037d5", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125843, "uuid": "ea20e2eb-7a19-4a6f-b022-47ee8243ab13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125843, "uuid": "01e175f1-4efc-419a-9bfa-d6cff0855cbe", "value": "PO8989843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1b1032-fee7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629155624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155624, "uuid": "d115c9f6-22f4-43cb-8d34-7fc9d45f7f3c", "comment": "Malware payload (Dridex)", "value": "3b88c0a7358ea0453cc39484f9530850", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155624, "uuid": "885a2037-9ab5-4f01-8f67-6616c9893aff", "comment": "Malware payload (Dridex)", "value": "8c65e3c2a068ca598e2ceaefc8e6e21a3bcf8d770521186081bda40ae1f74cb1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155624, "uuid": "b3c98840-76e5-4fac-af37-fb1be53b1057", "comment": "Malware payload (Dridex)", "value": "350587a998b4d5f00aa2f9f3009bfa788172d378", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155624, "uuid": "baf8ccd8-3e62-46c3-ae97-61021be2ef21", "comment": "Malware payload (Dridex)", "value": "a44e5289e1fc4b837b3536665a171579a4045ebe9a635ff55000c1a6320336e346bddb17752e604304c6307daad360c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629155624, "uuid": "0458c6ae-8934-4d6e-912b-6a0bdf6889e7", "value": "T13A34022958B7E270FBDA207D8C9E1FEA1BF18E1F11806713FBE5A25C9D08DE2119154B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629155624, "uuid": "ac617c70-66d1-4ebe-8b0c-1e6fb0ca3a4e", "value": "3072:Sq7AeN0RKSwCchO7e/1GrpdXx6sj848R1VuFX6KZOK/bQ6aOMVtAdstfOECWfDoN:SsNSLcq+YXEsoMFNF/bmZbtbbo6VwGds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629155624, "uuid": "28f9ddba-477c-45e5-b01b-f84f16a1c5f0", "value": 242465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629155624, "uuid": "e5f092e2-ccad-4112-b33f-cbc81c2d4204", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629155624, "uuid": "dcb434f5-6a06-4c69-90f2-11a7b5d744f7", "value": "taxve_8187469_20210816_8216662_59169160.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3733ed24-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629104777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104777, "uuid": "0b6ddc7b-b9ac-42a3-a4f1-2ee8b30db2a5", "comment": "Malware payload (DanaBot)", "value": "1ff80f00cb6c93fa94c5c6d7c9eee59e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104777, "uuid": "f77799cf-ac22-4afc-80ed-70dd80f4fd3a", "comment": "Malware payload (DanaBot)", "value": "8cb1fc91ce481e9313b2dd4923d1a3b29dfbcbed01d1a9b8c434d1a4eaedf968", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104777, "uuid": "e8bef32b-8886-4133-892f-d020522a4504", "comment": "Malware payload (DanaBot)", "value": "6106a1d39b247b81d875976b929789f56b80351f", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104777, "uuid": "f1c03669-fcc4-46df-a73c-3b092990d7c2", "comment": "Malware payload (DanaBot)", "value": "6a3608ad623dabea9f42b7d3c3bc487bd6c0cbef3da3e0cafa62f6997c9184e1fefbfbc8aec72780eb192b7eb8790fd9", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104777, "uuid": "c8b86d2d-81f2-4af8-ade3-686e634615d8", "value": "T10B35236CD50FD031C65A3272957BC72C1AB86F24CDD31ABF158839AA5F34FB091A6326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104777, "uuid": "c371a7a6-9c82-4fd9-8669-d4a27b241ac2", "value": "675f985c31bb43cb925f7664d8fe06b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104777, "uuid": "3278155e-488c-4902-9a08-7891429df615", "value": "24576:HI1KxVUIIYTVjtlRHAfQLCxwFei7ZQaXOUTe5:o1c15VprHixwFeiFhXOce5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104777, "uuid": "35c31030-79b6-4793-be95-4ea06df24a13", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104777, "uuid": "fad97a6b-abf7-432c-a5b0-eee1db24ce57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104777, "uuid": "969049fd-ead3-44c7-8dee-771da406395f", "value": "1ff80f00cb6c93fa94c5c6d7c9eee59e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e055a2-fe5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629095427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095427, "uuid": "02945fba-63c1-4826-9a9e-089a6767fd10", "comment": "Malware payload", "value": "12a7595d94e142847a04f11659ed183d", "object_relation": "md5", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095427, "uuid": "9c9f89d3-fce1-453d-b0ff-cda61245e16f", "comment": "Malware payload", "value": "8cfd554a936bd156c4ea29dfd54640d8f870b1ae7738c95ee258408eef0ab9e6", "object_relation": "sha256", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095427, "uuid": "9cf0e261-8d02-45e2-9cef-e842ddf9f0a4", "comment": "Malware payload", "value": "f80a2f102ca0297d053c75e0676049dc87cb3f35", "object_relation": "sha1", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095427, "uuid": "07c7e73b-a8be-496f-9e22-6780f08dedb7", "comment": "Malware payload", "value": "d377e74916f1757a480198f7410a45822cdf801f3de8184c4b05ca248f7f27ac629647e0708473ffc2447289e90b51b4", "object_relation": "sha3-384", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095427, "uuid": "5aa0b99c-fe89-44d2-b3c8-c6cb9c5265f3", "value": "T1AFF2A347E5AE90D6D8B5C036B567763BFCF23C964034AB3AAB908B1B0763620F51E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095427, "uuid": "cb909480-14e9-4f2d-98e5-783fd03b5436", "value": "9f86f12427bca134faaa21bcc0d849d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095427, "uuid": "4feb2526-6431-45d4-a6cc-f69d7ce4c8cd", "value": "768:sPcGOqEMccNNPayYDcfHyIY2QUy2h08wx:2cGOqEMccNEDuhY2FS84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095427, "uuid": "6f7db8d1-8577-41d0-b402-68b984dbe5ed", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095427, "uuid": "fdd6c93f-21a6-4089-b42d-9d29c8a6d35b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095427, "uuid": "75c3bcef-1c6f-425d-b885-bebd82fa67f0", "value": "8cfd554a936bd156c4ea29dfd54640d8f870b1ae7738c95ee258408eef0ab9e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e84293-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629132583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132583, "uuid": "656ca27f-13eb-43c2-92d1-6e8b65590dac", "comment": "Malware payload", "value": "0fc2a89c9512852e5df7aa8a0c580701", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132583, "uuid": "a0aa4616-0115-4127-b3ab-48a4f1c51862", "comment": "Malware payload", "value": "8e6cbe2f5d10c47ee4404da49e16b89e5f157ae37318c24ac31061f973d447e6", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132583, "uuid": "e13d6a5b-eaca-4a0f-af24-4ff799ecb695", "comment": "Malware payload", "value": "b6eb8a7b98451be58b2cdf815c301a81f70641ac", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132583, "uuid": "d6065853-b312-424a-99d4-fc882e21ec3e", "comment": "Malware payload", "value": "02f7fbbb720d27a7a6fff064506d0e43f3820a018200c3d4742bab1310e91ca70d1521a99335cf8a7c57a0c0afd6c0c4", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132583, "uuid": "175daf02-defe-43ce-9eac-d5edbbd47b67", "value": "T1F155120EA5E6F101D459813ECCEF98F48633FF656F2B8E89B133B91A147D4386A53126", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132583, "uuid": "46c3bec9-01f2-4a0f-82b8-19f2edca07ce", "value": "24576:hVkFimmFPwk4CO2lrEHjv5nRDzbUIPvrGKJdh6as8+zWbI0T1AfaT29H:orDDjv5nVrNuW1bDT1sBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132583, "uuid": "e307eec7-90f6-4632-bcc1-b58dedf3ecf8", "value": 1310088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132583, "uuid": "f7bece4f-d23a-418c-ab7f-cfa00ae20424", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132583, "uuid": "d538adde-1c20-4e6f-a3eb-b4c9ae8e3d84", "value": "shipping doc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b91b64-fe48-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1629087331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629087331, "uuid": "1d4adc94-cfc2-4184-990b-51d4209d9250", "comment": "Malware payload (DiamondFox)", "value": "de84761745481d3020af18fc0c3eef6e", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629087331, "uuid": "d8d40562-6864-4eae-b1a4-481d45cda38a", "comment": "Malware payload (DiamondFox)", "value": "8eea00bd7d1db820c7a1b5622119b76944215e5803c2e8b772b9548e9ee91c66", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629087331, "uuid": "bbecf667-ec0e-41ca-939a-c1c1643aca20", "comment": "Malware payload (DiamondFox)", "value": "99d980acadd231db0ec5cc73d39ee6e229a22475", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629087331, "uuid": "723f4549-5889-4313-9444-2c0c6443950e", "comment": "Malware payload (DiamondFox)", "value": "84ec22a0ce838b294c510c845a2f9109a7b3cd4bcbcba8d245c6ae5a40463d4e44794439405593df073b94d510a9b0a6", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629087331, "uuid": "601a11be-2916-418f-9797-3cd0a26bbf53", "value": "T17896338578A0C5B1C7F10D3A03A8B3A4647DAD201F2A4A9F53D4756FEE750C2EE356A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629087331, "uuid": "75a59a58-b108-40f5-ade2-e8c2453b9d94", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629087331, "uuid": "a4d242b8-c691-49c1-b66f-d168d382e757", "value": "196608:UaE5HysgxHk3wONlCTP86GU2JNdd8Ct8IV3hZ5P:1E5HUejeTPmUAjKCtN5FP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629087331, "uuid": "5ceef1a2-a5f1-459f-9985-d43d3d6eba78", "value": 8933385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629087331, "uuid": "4bda4b46-e3c8-4f4e-8294-b652cbbac175", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629087331, "uuid": "7890e09a-353c-44a1-8e5e-6251ae4b9cd8", "value": "DE84761745481D3020AF18FC0C3EEF6E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab08b01-fe69-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629101293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629101293, "uuid": "97d83b92-fd13-4a00-adcb-4b0c6669abd4", "comment": "Malware payload (Formbook)", "value": "c04f6348e7b59525aa07c2cff05891ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629101293, "uuid": "44215a84-85f1-4d5c-8988-626fc09c32c5", "comment": "Malware payload (Formbook)", "value": "8f28eb3a5a98a63955599167bc56f778544421f9e96fbb5502caa37e954db0fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629101293, "uuid": "913a309e-b102-4fdc-a75f-c333ad36ba09", "comment": "Malware payload (Formbook)", "value": "038757eb4a5e3bf1fa863f91e3f9494a074e5302", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629101293, "uuid": "108aa457-0515-4996-bdfa-f903d4fb1b18", "comment": "Malware payload (Formbook)", "value": "4fd7176e2ee01922e3a138bf0056190dfe290b93ace9dff7da5a77bae786b42e3c1ad84ba1b6da963f91703a26b78e13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629101293, "uuid": "6c98107f-e5c9-4aa1-be65-8e6b809af259", "value": "T1B6F4BF7171AB8996F51F8A742578BC5003B131F3A9C6893D1B5A614ACFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629101293, "uuid": "b0244067-3804-478c-aa01-0151c5b76c85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629101293, "uuid": "a7e88c33-5a92-4103-b692-72ac3074e196", "value": "12288:2uBB1MnbmI0rOkAKcc2FOaXaeVIJEl3c4FwcX29jcBX5JOEPpBja:DBgbjLk9cc2FXaJ1U2mBJHPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629101293, "uuid": "15f31ca5-e724-4e2b-8649-7828a91aaeb9", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629101293, "uuid": "93cf4273-7ee9-47e9-b3c7-01237de5b1f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629101293, "uuid": "4e56aff1-484c-4c13-a927-c0bb24fc9c09", "value": "c04f6348e7b59525aa07c2cff05891ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd02c929-fe27-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629073246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629073246, "uuid": "06cdf067-0d09-4c04-b36e-d28e7d713afb", "comment": "Malware payload (RedLineStealer)", "value": "9f516819ee3619fdbbb6636b1b8a0462", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629073246, "uuid": "f7fbd134-05f1-4589-a5be-3294da3026e7", "comment": "Malware payload (RedLineStealer)", "value": "8f38a8b1fc30c406eeb6877e201fb46b465954da4c356dea81b29d804c96712e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629073246, "uuid": "6e7518f4-0a87-48a6-bfe6-b8d0c87e59f9", "comment": "Malware payload (RedLineStealer)", "value": "2010ae8ed9a695aa70648413f109655176db5968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629073246, "uuid": "889dda91-ccbb-4deb-b52d-ed86d0fa9804", "comment": "Malware payload (RedLineStealer)", "value": "34092cceb8f0354ca770497cdf335524e98513b1341bbb1c84026803c769cec324d25dfd3542669b8bc2d03a8ca30c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629073246, "uuid": "64a3af79-c02d-4634-8cd1-412b4781b9f6", "value": "T1A504AE1175C1C1B3C4B7113045E6CB799A7A3072076A95E7BBDD1BBA6E203E1A3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629073246, "uuid": "8188af2b-5b41-4330-adbb-5eeabe066533", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629073246, "uuid": "0052743e-a3ee-4777-9ffb-83df6ec47c51", "value": "3072:SDKW1LgppLRHMY0TBfJvjcTp5X5NArT0Xj+PRusWC:SDKW1Lgbdl0TBBvjc/5NArTGj+5usj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629073246, "uuid": "2ad6ffb6-5f6f-4cc1-87b3-2192bec8d6ac", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629073246, "uuid": "d85ee519-359d-49f3-b7eb-cff551be8510", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629073246, "uuid": "5eaa1773-fbfd-4b10-bd64-caf3ec6050e1", "value": "9F516819EE3619FDBBB6636B1B8A0462.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92c73b5-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629105049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105049, "uuid": "6813abc8-d14a-4e8a-b293-2192de17377e", "comment": "Malware payload (Loki)", "value": "ddef0570690db3b804798ad28a011d04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105049, "uuid": "36038d5c-4b17-4dd2-8c91-9b3cc3cacc91", "comment": "Malware payload (Loki)", "value": "8fd7318d961b667f108d7c432cd81662dff4abd2391cc8015e99793c9fd08bd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105049, "uuid": "f580bd29-c049-43ac-83c9-f4387d165744", "comment": "Malware payload (Loki)", "value": "3a2fca0ff4bd319101ae37efef28986c85e5e148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105049, "uuid": "502b4952-5e54-42d9-8f72-e5e50f8e2b05", "comment": "Malware payload (Loki)", "value": "0c6e2422c3891c3e02fd648fbd799e73408e4f2f87f4fdb08e07ee6b5e943d005bbcc3143dcb4960c08ab8c93c80875b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105049, "uuid": "172b29bb-7179-4bb0-9cbd-949585c74c6e", "value": "T164E31976B1C7E842FC04DD7022098625BE1F7C232646AE4BB522630E29F65F2E9F454F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105049, "uuid": "b911e7a9-d34d-4996-a781-d0bcc4b090f6", "value": "2b4f5fe80df3ed9a6d3159464b73e6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105049, "uuid": "81e62b35-dfe8-4dea-b5d9-779787aa0260", "value": "1536:CkUvfHwQ8uSHod7kqqT7Cdn+Mut/q1nVJFgR7f:1C4QEod4fCd+Jt/q19gxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629105049, "uuid": "68c16420-c81f-4a6c-8da2-8772c8b63632", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629105049, "uuid": "50457ca0-14bb-469a-88b3-408437125e69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105049, "uuid": "f8e2118f-b180-409e-84f5-0e27c6bcb61e", "value": "Poldoo8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7ed98c-fe8c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629116439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116439, "uuid": "2a21dce3-b2bc-4954-a835-e2ac9dd5089d", "comment": "Malware payload (RedLineStealer)", "value": "18fff68fe353ec8d6016fac7aebf422a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116439, "uuid": "f037854f-36fe-47c7-822a-e193d549a1c7", "comment": "Malware payload (RedLineStealer)", "value": "9072f90e16a2357f2d7e34713fe7458e65aae6e77eeb2c67177cf87d145eb1a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116439, "uuid": "2d17d5c6-7787-4a10-8fe8-204e634c264d", "comment": "Malware payload (RedLineStealer)", "value": "3aab6954361961a5c395fd743cc1bc97ebd13015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116439, "uuid": "a7f0d9bc-6c1c-4c96-bdfd-1aba5d37f783", "comment": "Malware payload (RedLineStealer)", "value": "f67fa23f6e8fbdd18cac06a073584eeb6bcee9eb1b325c34feeff621e869bffe64296bee3be52615b9c849e2a65e062d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116439, "uuid": "de2a8cb8-cac3-45e9-b074-e6f0a93a9c80", "value": "T1A554E02E794FC872C79A303584B3CB6C8969BB20F253057B16991EAE5E31FF06366345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116439, "uuid": "ddd96398-cda0-47bb-b345-d775b5fa39ae", "value": "894d0e2453b674d7fa4cc3ff89ddc063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116439, "uuid": "47cf36f7-762b-4ba6-8f00-f21b0bc913bc", "value": "6144:ULdP4G/ndIL8PqWuEIjp8Rib7prSc/mMsc:UxP4k/yWuEspb7t9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629116439, "uuid": "9b6f5948-6d7b-460a-8bd9-2f611aca7797", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629116439, "uuid": "6f1024ef-4502-45e9-8c88-e30046e439ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116439, "uuid": "774fd552-65bb-4a4d-b834-71bf93535d02", "value": "18fff68fe353ec8d6016fac7aebf422a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad0ca5b-fed7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629148672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148672, "uuid": "f5934a40-8d12-4893-b9d6-ffc46b2665f4", "comment": "Malware payload (Dridex)", "value": "9bc8137da8d29b6792f036a3fd4aedbb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148672, "uuid": "f08dd554-e1ef-4651-b502-c3f8694b2e02", "comment": "Malware payload (Dridex)", "value": "9185532b309a86813f3fedc1ad02d0c1a36ab9d1f09db28337080032b094ba0e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148672, "uuid": "6f45b035-e1f5-48ca-a566-e60474564a37", "comment": "Malware payload (Dridex)", "value": "9c941c9a1e2e439eaae618a99b39f967510abd1d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148672, "uuid": "3c87b160-800e-4211-b81f-c3649138f9e9", "comment": "Malware payload (Dridex)", "value": "662b6b263d4dd4c6ac8f4217d63dbaaa220a8d916c73c5730e5f884cd850c8142496720baa032ca705fc7e1a2d38ed00", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148672, "uuid": "14a02e1d-132a-4669-abc6-d52b3157b526", "value": "T1F064125A04A3E154DFA600765C490FEA3BF58A3F41909B8EFAD5F31EE909CE701946CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148672, "uuid": "a8f7c8f2-e33f-468a-b7f6-b8a69a7f5c3f", "value": "6144:SbNSLcq+YXEsqIzizEms7/CccIf8l8ddIE8Q9r52O8zXpMaRCUEJisLWWj0:MPYXEsLOzEmiGc8+r52RLmacUCL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629148672, "uuid": "1a91905a-c569-4d5a-b75b-82833d7c8a1a", "value": 315271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629148672, "uuid": "4fa17cb3-e4b2-4581-861e-e3978d1e6b93", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148672, "uuid": "e2c99c47-ec71-41ce-9b03-afa82fce4b92", "value": "taxve_689614_20210816_73434_574337.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86419dd-fed7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629148883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148883, "uuid": "2d621e6a-9d93-4a66-b260-008d6f3152af", "comment": "Malware payload (Dridex)", "value": "d09b437fa66a522e60bb3e75f447a15c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148883, "uuid": "a0731c18-2ab3-4c85-acdf-0463604d1ecf", "comment": "Malware payload (Dridex)", "value": "92b59fb415c38c50cf732fa7b1cdabac16b961e447283b3b579a4bb720befa27", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148883, "uuid": "b91a4acc-2385-4214-8cbc-21b8e41251d9", "comment": "Malware payload (Dridex)", "value": "f782990d26498df6861e3b726d71bfba79bf65af", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148883, "uuid": "54aa24e6-1db1-4ee7-9eef-e237fb40bce0", "comment": "Malware payload (Dridex)", "value": "bdd4c30fa7165e0bf9bae5bab107d73cb22aec596763936897b41c1d52d7cda93519318e68f383608a9b57f86aef9926", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148883, "uuid": "2f0bb8c5-d334-421d-9ccb-f0d3cab7e25d", "value": "T15F6402190477E1D4DB6280379CCB2FDA2BE5CFAF61A06A43F2F1BA1DAD09DE71150189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148883, "uuid": "08b4fe14-4eb0-49cf-9956-5931f8993df7", "value": "6144:SxNSLcq+YXEsOEnCTX5Vs1sYrB3PV1oME7DwhOw:CPYXEsOEnCta1rtP7vtht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629148883, "uuid": "a03a6422-566e-49c0-94dc-0a023568ff12", "value": 308565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629148883, "uuid": "3168859e-7f1c-42fb-8596-08993bf72d4b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148883, "uuid": "4a46e6ed-0399-4e78-b414-d24e1d1f950b", "value": "taxve_09920184_20210816_001339268_869607958.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b70778-fe8a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629115745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115745, "uuid": "747f8d2f-a0f6-43e1-907a-1fe8f81bb43f", "comment": "Malware payload (RemcosRAT)", "value": "7a06ee20a8cf9057c0313c2dd9b52dcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115745, "uuid": "4abd7e5a-d124-4579-a3e5-93b57dced61b", "comment": "Malware payload (RemcosRAT)", "value": "9325090b7a2b8058a946f11388db15813a8927708aa54bf9aa6b5925f2b22d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115745, "uuid": "9f755f80-16cb-4972-87a4-71436fc8a8ea", "comment": "Malware payload (RemcosRAT)", "value": "eaee1819a3291b7d08ebcbf33101cc1a5195a082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115745, "uuid": "5e292db7-af66-4caa-985a-78bccdaed000", "comment": "Malware payload (RemcosRAT)", "value": "71709add10dde892b2525cb205a12a2289cbd08cf09a5b95509e0eb73e253d8b3b36e8557b5d302f7e0e649b6fb612f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115745, "uuid": "8dc943d3-25b2-4387-887a-6714a8b3013a", "value": "T17A058E62A1898437E5A316389F4F06FD9CB27F013539649E1BEE38894F76762383B447", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115745, "uuid": "5d70cb06-10e2-4ada-a66a-a39d56eaabe0", "value": "1abe4551dd4f8ef04deab38d0027e326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115745, "uuid": "49804cd8-4b80-49a0-9fd3-bebf1fb5eed2", "value": "12288:WhxUck0fyI/Xv94r0umLKC+pvbIAsrxPz+o8wcF:WhGdkF4r0uvnDIFpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629115745, "uuid": "00e15371-9f8b-4ffa-baa0-9868a4686d1d", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629115745, "uuid": "07009043-ec34-48fa-8ce7-e69ee8265e3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115745, "uuid": "34357c57-7ada-4f5e-9e19-0c0322adb473", "value": "Ynt Sipari\u015f Onay\u0131-5309,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785c31ab-fe5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629095437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095437, "uuid": "88385808-0232-4338-a297-22cf3a6a96c0", "comment": "Malware payload", "value": "4af8b45c9b0f73d47a499d92064b6c2e", "object_relation": "md5", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095437, "uuid": "de3d4e2b-5cd9-4903-b1d6-087848b8435f", "comment": "Malware payload", "value": "934c557e52bd47fa312ea4098e05781145d0b81c9dc543ef42b266813bdb05d4", "object_relation": "sha256", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095437, "uuid": "1176c9b9-c96e-4540-ab57-c05cd400a594", "comment": "Malware payload", "value": "424f3c281f46e4cf2350c78cfa89a87873e0b994", "object_relation": "sha1", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095437, "uuid": "b0294884-ba4a-4a0e-bf85-f4dc030b8958", "comment": "Malware payload", "value": "ddc8dc26a25ab63720a52212468dd554ef86baa5d0f8dc66bd5314fd887b73b1a416beec931d5d48b6dc79bfce164ab4", "object_relation": "sha3-384", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095437, "uuid": "9e7bf4de-e36b-465f-b0e7-0179f77e3b80", "value": "T16CF2B443E5AE41D6D4B5C036A127762BF8F17CA64134AF3AAB508B5B1B63B30F91E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095437, "uuid": "778eff55-5ed1-443c-a975-1832487324cc", "value": "6473877da5764bbd5a9b16892ef13b69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095437, "uuid": "7666aee4-1d3a-4c89-a160-0aaaef4ee97a", "value": "768:9vutX7Qp6CPRp8Yh/ZYWcGOqEMUcgk9/Y7hCeUpU:K7QpJp8YFrcGOqEMUcg0/Y7lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095437, "uuid": "20eadb7a-fd14-4941-9d7d-a1794e93d6de", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095437, "uuid": "3872bdb9-ea75-4837-a2b6-afa632c4b996", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095437, "uuid": "d717c293-5991-493f-a0b6-e9fc2d153700", "value": "934c557e52bd47fa312ea4098e05781145d0b81c9dc543ef42b266813bdb05d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d266e71f-fedb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629150564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150564, "uuid": "6301fb2d-efe5-479c-abb3-822aff01e77e", "comment": "Malware payload (Dridex)", "value": "e59aabb873cc64d53b411042a3a08f50", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150564, "uuid": "19fe4178-f3d3-4903-9bd7-201cadb7972e", "comment": "Malware payload (Dridex)", "value": "9353bc1af772de7c4de809d174add7135cfadd389f388d316e81e7e14a215fee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150564, "uuid": "5662436e-f4a8-45c4-920e-7b347f89dc69", "comment": "Malware payload (Dridex)", "value": "d2ff9f9cdc1471f80ec88578555e86e29d883d2f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150564, "uuid": "90882d87-71ff-4c0a-9f89-e9e28a9efe08", "comment": "Malware payload (Dridex)", "value": "5654d0c73223b088a20b6bfbde587961e8fb3db78585cd7992cf21575d94dc9218388eb9c6dd9a4e629f12e8815eb65f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150564, "uuid": "b336d75c-ef00-4565-9619-d378878f7607", "value": "T1593401284373F664F99B60394CDB2FEE23764E6B52502B4BF5D8A61DDE06CE3518018B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150564, "uuid": "a0a3485e-48af-4d2f-b938-472a9b4a9423", "value": "3072:SzAeN0RKSwCchO7e/1GrpdXx6sj848RTPxCaJRXf219ZHxwYo+ywNPt3mlwC5int:STNSLcq+YXEs0Bc3lqwv3MtA8bnM6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629150564, "uuid": "6e041cca-fc54-45b4-90ef-a565fb647cec", "value": 241918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629150564, "uuid": "66b50d84-fa74-4d12-a9d8-74fd41bcb5d7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150564, "uuid": "aeea4bcf-c177-444c-891a-8ef865b42e42", "value": "taxve_0797757935_20210816_92462_84596922.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcb0388-fe6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629103422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103422, "uuid": "9cde3801-0a79-4eda-af4f-6980a3488d7e", "comment": "Malware payload (Loki)", "value": "4b79e0b292388c830e71dd54a38d5725", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103422, "uuid": "6f51d0d6-45fc-4760-8e1b-c6ad5fdcf3ce", "comment": "Malware payload (Loki)", "value": "9533a57de211ba22034a632e24ad84474cb8340ac961fab9c295d0ebe6b127c0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103422, "uuid": "6a9f4ff5-9480-4254-88ac-915afd314bad", "comment": "Malware payload (Loki)", "value": "ffc2c99cb8eb3bbd5f978665aa8cb5811c2df025", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103422, "uuid": "e3dcb1c4-90e3-4b06-a5f5-db41c56eaa25", "comment": "Malware payload (Loki)", "value": "e2bfc2073cb9a339e1a753b77f267a41389ed81b675cb642d47e3ad53b85c44fced8a02222903a16f445392897c1285b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103422, "uuid": "beaa5760-55dc-4155-974c-272a010c1398", "value": "T18F552217E8195B1BC50E047C37EFB2A16DBA8C463706E24956CAB070E5BD43AF58F384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103422, "uuid": "582ab41e-7637-4193-9fdb-9516d26d490c", "value": "24576:xgmFf0LXT/h4hz1M3mk4+lltJQF99xyxWvHOsmIpbOKeKwT5GgVqrxeCeha:h2J4hq34Ilo9xTOsmCO6wVGOqr+ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629103422, "uuid": "81b77e45-997b-4908-8dc9-c31280ceba5e", "value": 1354040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629103422, "uuid": "a8ef8a8c-11d2-4ada-b327-07d5bd3111fe", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103422, "uuid": "ca94c694-f56f-45f5-a5fb-886153d42f33", "value": "shipping doc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d90f39-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Socelars)", "timestamp": 1629114462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114462, "uuid": "f3ec70c9-7af7-444f-80db-8a648d540836", "comment": "Malware payload (Socelars)", "value": "e53d8b8f8aebcd44b5cc9226e42e9f27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114462, "uuid": "ea6d1caf-bc1f-4da3-b317-55f8b508edae", "comment": "Malware payload (Socelars)", "value": "95405f49fbdcd011e42d383d8f25af072519c384fa83de4bc2ffdcd73ba731fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114462, "uuid": "9c655873-30b9-4dc1-b227-5fa81439460a", "comment": "Malware payload (Socelars)", "value": "989daf2057ffd51cdb3ad6df01178bbdd7864839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114462, "uuid": "4c5d57fc-3b6e-44e2-a1aa-dcb953309e2a", "comment": "Malware payload (Socelars)", "value": "6ad26ad81287b6e8503403822f9cf527d720f9945bec805234bf28f8cedf359e3120bcf9d1e5eb6b28ba9abf963a2d87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114462, "uuid": "233e53d6-3d75-423e-ad97-13dabc1cd06e", "value": "T1FF659F21F6429036F8E310B286FE477E9D68BA21031454D7E3C42D6E9E719E27A3B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114462, "uuid": "e0660dfe-9394-47d6-b92a-49f8fe0aaee1", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114462, "uuid": "cb907345-785c-4226-bef4-7fca3b6669a2", "value": "24576:3IVFA1pqtg/TnMbX0lwyh0FVmEByA1swFYyOsdwsuQOSIt21QRYfNowP:WFA1pvTMbOwa0TmUqMYEOFQOSIsQRYlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114462, "uuid": "f27d35ab-7a34-46f8-a98a-d551a2ff0e18", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114462, "uuid": "844d55af-ef80-4d1f-b597-d3127744a4b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114462, "uuid": "d1d0cdd1-f25a-469a-bcdb-e7429b70a9ab", "value": "e53d8b8f8aebcd44b5cc9226e42e9f27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08abb7fa-fe8a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629115436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115436, "uuid": "e6c21c61-333c-4b75-b9e3-dbbf25420af4", "comment": "Malware payload (Smoke Loader)", "value": "ee3b8fdd3fccf423686ee12bc1eb8768", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115436, "uuid": "73b347d4-99da-4cbd-ad45-a64a695e14da", "comment": "Malware payload (Smoke Loader)", "value": "95d9e11ec01f83253ab4bd861de609f52b101c160214612d5ffa615f3c931a7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115436, "uuid": "0cff71b7-0d02-4e57-a025-ad6c65e75925", "comment": "Malware payload (Smoke Loader)", "value": "9e0d8a41272cd0ac7a67a4dee85ab805eac07345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115436, "uuid": "deee1571-6b64-4d17-8121-e4a937604664", "comment": "Malware payload (Smoke Loader)", "value": "e3371518aa27d519b44ce0e98da2352d326e20d2429660e1cf39290bc36e72f9078f3aba464cae943afdd41c9b0be32c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115436, "uuid": "70f78d68-4d2f-4a6b-ac1b-63e6e4c015b8", "value": "T1E704BE2D759FC272C783313044B38BAC5A38EF20DA63057B678A266E5E30EF19576359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115436, "uuid": "d304a77a-f5f8-4939-9db4-f8bac8d5a75c", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115436, "uuid": "227c656b-fce2-4cda-82d0-75a74294bf20", "value": "3072:1ELTWW/LnTkIbc0j2K1wQBNRuRpc/mH13CGZ7yq:SL1zTkIA0jD1w4cc/mH0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629115436, "uuid": "11fc0008-2021-4503-a333-3c26ce7b0e98", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629115436, "uuid": "eec2d13c-6224-4fa7-8c69-0a9db364255d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115436, "uuid": "d6e18b6c-1cd1-481c-a797-8e22b8529189", "value": "ee3b8fdd3fccf423686ee12bc1eb8768.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5349714-feb9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629135939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135939, "uuid": "f0e1c227-afa4-4a0e-864b-75513d857a02", "comment": "Malware payload (Mirai)", "value": "8c38632e2faa6770099c2d340adab0fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135939, "uuid": "567413a8-071e-484a-8226-187638ce5e56", "comment": "Malware payload (Mirai)", "value": "9671fb578d732ce694c0b434d247775ae4dc81827dd868b7f88881ac44cbc3a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135939, "uuid": "7faa6dc1-c94d-435d-aac9-ef928f5bdc3b", "comment": "Malware payload (Mirai)", "value": "a445f550039acb0288428f88b60c47f1b163bf21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135939, "uuid": "92997f42-1896-4482-869a-82ea003356c8", "comment": "Malware payload (Mirai)", "value": "513147159b3a28234f0f416d63726a32ccaa2105e2d34bd32e0830a6a616e601ec0690a50cc9039f9488bf8f8c30e2cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135939, "uuid": "2b2d119d-78d8-463d-9c1a-00f46da66695", "value": "T18562B0614B9D7421C1E01C73F5A1094A2B260FFCE0D7B9B6A770D6B0BDD72561EF9842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135939, "uuid": "5c631cf8-4497-4eed-a8f5-12b9c4201eed", "value": "384:C3XH/d2/xUxd6dKEPyarScdjoEwyt5mdGU5Ec:C33+1KEPpdjZN3U/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629135939, "uuid": "bd47f335-02a2-4ec7-95ff-46a8da5bce67", "value": 15928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629135939, "uuid": "8a627581-6675-4e5e-9573-37b9fc7b3639", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135939, "uuid": "34e0e5e4-d73c-429a-91be-478e1cf98818", "value": "8c38632e2faa6770099c2d340adab0fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e01419-fedb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629150354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150354, "uuid": "11ef4945-aad5-4933-a6b4-fdfa73bda9a0", "comment": "Malware payload (Dridex)", "value": "77aff97d2a700e5759dd1814a03928d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150354, "uuid": "25cc21e1-029d-4fde-ac0f-8f6cb8dfd02a", "comment": "Malware payload (Dridex)", "value": "96e022c8a6dd2f59f54f33f464bb1c51d703f9bf62cd6dbc42c1165c3f79e5b5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150354, "uuid": "c2d198ab-b274-49cf-89dc-be168b201384", "comment": "Malware payload (Dridex)", "value": "5d9cc51be079a4d46e6fe8c96dcc78708f618839", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150354, "uuid": "1baa602b-5fed-4874-a03b-6b288cc12cda", "comment": "Malware payload (Dridex)", "value": "8c006ac05d9e5f1ee5ff0da1dae3c74c6502f3f6393a651493d28e818317c9096f88ff45f18fb1bae76bbdd5a57f0cb3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150354, "uuid": "263aff66-61f6-44ad-8f21-8270b7bfa15a", "value": "T12144022E41F7E214EAE7507A8DDF0FE997B04D2B25D07756FAD2D40D9E08DD2228098E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150354, "uuid": "582d697a-c1dc-429a-bfd2-52edd17433ed", "value": "6144:SqNSLcq+YXEsGWIOni0+h6EFcRxAHKgr5zou:BPYXEsIOiwRxAHK+5zou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629150354, "uuid": "53871bf7-6994-4ae1-a471-4bf112115e19", "value": 273476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629150354, "uuid": "d29d27eb-b9a9-4e8e-884b-e68f7f6be011", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150354, "uuid": "ff1ed139-4daf-4ff5-bf68-0012038247cf", "value": "taxve_1787616_20210816_2865303_566584054.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030e2689-fe83-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629112421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112421, "uuid": "146469a4-720e-43e1-92e8-248b94a97b4f", "comment": "Malware payload (SnakeKeylogger)", "value": "19350f85baaf238d40a4a3c1d580a001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112421, "uuid": "73393f42-4971-4d67-83f1-098f880280e9", "comment": "Malware payload (SnakeKeylogger)", "value": "971800a35991b464ba023308f74095eed8b1a16191b40efb0650ed761a1d090a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112421, "uuid": "c1ae93f4-3066-4570-bb48-de8997c3132f", "comment": "Malware payload (SnakeKeylogger)", "value": "12d1d0e4b0b968b764cc9256860663d1cb94b224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112421, "uuid": "9bb23629-6b95-409b-bc1e-abdea19b0d12", "comment": "Malware payload (SnakeKeylogger)", "value": "d782de3921d235d48ccddb80da952b42413ee835cb85c32b72cc2eea13c123f57c839857e88bf4fdaf334fb78f3a3153", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112421, "uuid": "03645993-a74c-490a-b831-0873b12a08ab", "value": "T1A305AD3814680B63D67AA6B7C165A310EFF05D667241DD1A4ED3F8C72E12B431A8EE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112421, "uuid": "c9254751-27fb-4724-9f73-c0076fae0c18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112421, "uuid": "621ddc64-2ce3-4428-bbfd-69fdcfdfc3e2", "value": "24576:yVdV2vrO4+y0fpLhCIogQMWRR5Z9U+w6:cb2My4l1ohq+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629112421, "uuid": "e861e4cf-bb8b-4030-9432-a2eb1741e8ed", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629112421, "uuid": "8e6b72de-f6e1-4951-a758-949f4bff8e21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112421, "uuid": "7d64fc03-c35a-4f0a-bec0-bd0cf6295de6", "value": "971800a35991b464ba023308f74095eed8b1a16191b40efb0650ed761a1d090a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91af5853-fed0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629145731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145731, "uuid": "da70c55f-7e01-41af-8530-24cd2e16f97a", "comment": "Malware payload (Dridex)", "value": "93ebbf5b027acf34dce22ffb21dcf2e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145731, "uuid": "6d1dd27e-9610-4484-b9f6-b142b1bee02a", "comment": "Malware payload (Dridex)", "value": "9794c95688a8455c9a8e600e974789a95faacae9acfaea4c052237de0cfa7b25", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145731, "uuid": "df212f3e-42a9-4dd5-b2ae-bd53af81b3d5", "comment": "Malware payload (Dridex)", "value": "9a97d3c72af13bc7cc4732b8e2456b32b096b456", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145731, "uuid": "31f0a9b9-49d9-4fd7-9bfc-d2bb86523df4", "comment": "Malware payload (Dridex)", "value": "38ef5f08ba304116a31a7f8508c5d755b59bc9e0164e68fbbd4ac59e7c287f23cd3887f315615607f1fe5e8341e2f576", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145731, "uuid": "3e7ab39f-bd8d-4a2b-844d-b6d43c20afc0", "value": "T1025401846803D51CFE8F6E79CCEF25B1AF99CE6E1900221F71A1A11CE2F13E45D598C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145731, "uuid": "b99572b3-5942-4514-99c1-45929c28c8eb", "value": "6144:SNtZbAPPimNA/kjoitk/y2Bus9ARotnKJg5N3S:mtZbAPDNAcMDhJXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629145731, "uuid": "bc69699c-79e1-4192-86b8-bd3358cfa9ee", "value": 290887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629145731, "uuid": "26440a50-cc00-4f0a-a827-753e89847367", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145731, "uuid": "c75e2ee6-90d2-4873-9a46-65e6c14c8da5", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_6895077.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5b188d-fe77-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629107688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107688, "uuid": "4e73f928-c33f-48d3-85f1-f720705f5b33", "comment": "Malware payload (Gozi)", "value": "fc6677c3c47e773d193ee88c76349c8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107688, "uuid": "7e747b89-5de2-49cd-aded-f2608282dcd2", "comment": "Malware payload (Gozi)", "value": "980771895c8880731bbe04e99264bcadd78d4dc9b41eee0402759d39d39c4b61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107688, "uuid": "172f0c47-e91d-4386-a122-e4ba942d7eb8", "comment": "Malware payload (Gozi)", "value": "8a1015393e301aeb77435a75749ca0608229256b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107688, "uuid": "1028535c-28d4-4053-b0c3-70331682913d", "comment": "Malware payload (Gozi)", "value": "8658232ed88cf85a33ed44bf510e7e9298b769742dcf40b9fa925c7fd0abdae90f617848180d69fa9b0e7cfd33b4ac25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107688, "uuid": "6c564707-e0e1-4aea-b98e-841c04685240", "value": "T151347D6AE2A40A95EDBBD5B9C993C617D7F334490B64C34F13B0CA5A6F53321B21C382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107688, "uuid": "b6c76805-2472-4aa7-9b0a-62a1fe995b92", "value": "6144:tmnZO0GDlypHAT/cxkDyPFXkfh+3m33c51Wjak4SdS83x:tMZOrEpHAT/cLPF0Im3s51WjaCU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629107688, "uuid": "df363713-3043-4d3a-95d2-b99da853c280", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629107688, "uuid": "e4875dd9-224a-4042-ae0f-166f84b0e292", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107688, "uuid": "ee566196-d7f2-447b-b63d-cca22b5152ce", "value": "1f26eb50000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a39082-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629134143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134143, "uuid": "32ceaeec-4284-4538-ad41-c065b4a33f42", "comment": "Malware payload (Smoke Loader)", "value": "488935e18ff624c2b3ce582665c5f554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134143, "uuid": "ed116783-a0dc-4a5f-9d84-4f77b55f6994", "comment": "Malware payload (Smoke Loader)", "value": "9838a4a902ce7a56adf417d595b7d98258f1ccd6a2b6beebdfd43133edeaacd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134143, "uuid": "5c5a97b9-beaa-422b-8952-77cb6b7d43d3", "comment": "Malware payload (Smoke Loader)", "value": "bf47923ee49f735ad367a19a41dad2c1c6e48db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134143, "uuid": "62012ee0-ad9c-4f05-a709-9263178daf9e", "comment": "Malware payload (Smoke Loader)", "value": "208ae644ccca67b4871b1a530b6b3f7423b58d0b77782a97a4c7d7abe6175d4d98867ee5604318f343de8c1beeb4966c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134143, "uuid": "714206fd-85f0-408b-a3fb-62cd9c859412", "value": "T1E804CF2DB59FC072E38235350473CBAC1D79AB21DA53093B2798296F5F30EF056263A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134143, "uuid": "18d46dd9-12ba-43d4-81e1-2c8dc11650f5", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134143, "uuid": "f6b06d8f-39f5-4efa-9f48-cb8531f33704", "value": "3072:uELTWW/LnTd82FgUODbBNR7R6c/mo9b8Z7yq:DL1zTSFMc/mo9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134143, "uuid": "9f51c453-6631-4a59-aa09-c45087be00f0", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134143, "uuid": "56113b3e-6945-473a-8088-b3340a575803", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134143, "uuid": "195097a7-05e5-478c-bc84-ff04cbbfc468", "value": "488935e18ff624c2b3ce582665c5f554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22a6d7a-fee2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629153517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153517, "uuid": "fe13e11b-9342-4504-8ef2-8f67026c4a61", "comment": "Malware payload (Dridex)", "value": "2599b6b6ff6083d8b4da05218595a338", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153517, "uuid": "8ef1d83c-2cf6-483a-aff0-25bad135728d", "comment": "Malware payload (Dridex)", "value": "9924687344bd2fe391ca60e2c99c4fba5ad46daad1883a303177fa01be289004", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153517, "uuid": "897c5a08-cbb7-4a86-b83f-b2008c73cd9c", "comment": "Malware payload (Dridex)", "value": "d591b537333fcf37ccf944443e08403122852f18", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629153517, "uuid": "d417522f-05e1-4523-9c8c-c590b7c59a09", "comment": "Malware payload (Dridex)", "value": "bacc7de34f59990631fba2f40fb9f69149654f3cfcbdff2171bd1606af28fe630e63002bdb6ce6cd10bb368f737ef4fe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153517, "uuid": "a2ba3fe4-c1d9-49d8-b8e3-53c3531e9c32", "value": "T12B44F1986553F5ADFA8F6DBD8CCE28B46F89CCAE1504153F22B1A60CDEC03D65C215CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153517, "uuid": "a4b58eff-3f9a-4aa4-97e7-a314209f5178", "value": "6144:SztZbAPPimNA/kjoitkvCVFWKMJH/doqIJuBS4EIR5qVxAzz:ytZbAPDNAcM/Y9qfduJCS4zqV63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629153517, "uuid": "869e2e3b-1b0e-4af4-8717-623d31024a37", "value": 259656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629153517, "uuid": "bda1e75f-c291-4daf-bf7e-1138c079ca81", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629153517, "uuid": "ebcef624-d266-4bae-8009-7c0ad5553a69", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_4_79421994.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e110df-fec2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629139665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139665, "uuid": "f8b153d7-5da8-4a4c-b749-38cbfc47f6a6", "comment": "Malware payload (DanaBot)", "value": "18e0d922bead757af754e54cc744eaa0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139665, "uuid": "4bd3324d-59cb-45b6-9a75-ad609e8f545a", "comment": "Malware payload (DanaBot)", "value": "99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139665, "uuid": "0c8aa577-0d72-4b79-b860-d4135d566fe0", "comment": "Malware payload (DanaBot)", "value": "22a03fbc28e0dadf13e1ace67109b1dc3e91d0f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139665, "uuid": "959fdf77-6abf-4b03-a901-b5f1cdeab4f1", "comment": "Malware payload (DanaBot)", "value": "6681dff365b9dbc945c9179fa06d368544dc68dcf213062d12093d074a1b66f22905c6770431c2159052a122e880a47c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139665, "uuid": "81161d2f-89da-4fc0-ab2f-cc7ca7180183", "value": "T1E1352301B610C972C1EB57B014A2FEE1E0267AD1F1936D972BF6392F7FA03C192DA255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139665, "uuid": "160ea7ba-08c7-4b9f-aa55-77c9cc7b67b5", "value": "e13582e50ecb7af95558f57b919f6a34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139665, "uuid": "d5182372-3060-4b50-be35-77bff898267c", "value": "24576:gQ8nt67av7QEet8tYFKOYZDcdW1PIe+W15X1d:4nt6+vUEetcC7Y5cdW1PIe+GZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629139665, "uuid": "e4fa271b-4722-46fa-b904-0589125b4444", "value": 1119744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629139665, "uuid": "6e155ae5-86a8-436a-b2ea-70db557a6c36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139665, "uuid": "d27d863f-a464-4861-adb2-b9be0aeea200", "value": "18e0d922bead757af754e54cc744eaa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d2dd49-fe5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629095487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095487, "uuid": "1ad45468-f66c-4daf-8bd2-e280b4a4ecc1", "comment": "Malware payload (Formbook)", "value": "f8974c98f35979dc47ef297300216205", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095487, "uuid": "0ad2e658-578b-4ea0-9c73-8bce11cd71af", "comment": "Malware payload (Formbook)", "value": "9a70c87569365146a5ae6d0d933c54e53784f268ed764285e2df61691864249a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095487, "uuid": "858dc3af-b497-4337-8309-5086509a42e8", "comment": "Malware payload (Formbook)", "value": "be26ae3b322488ae20218930ad7170095933a89b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095487, "uuid": "fa94aa74-93bf-4e2a-acbd-f0a15e5ad050", "comment": "Malware payload (Formbook)", "value": "553c0e41102dee875d3592089ad26ac7f0da03883671a49932921d4baa7e58e507038d71c6d894c08f24426bfee2cd02", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095487, "uuid": "75669b56-7983-4e19-a2e3-17b5d3b5c5ae", "value": "T189D4335FAA196FF3B8400BD4095F98DE3C9F95A96D3C0AA10CF97BCBA990C1C519E4D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095487, "uuid": "2c8589fa-114f-489c-b2ef-bfb009b9cd88", "value": "12288:6ylhn6MtWV/pTvpskt1o1t+BPQG5OxcLuzeSAn85rx/eAjh:BHn6M8VxBwjA4tzKQxNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095487, "uuid": "d418a04d-907b-48dd-9383-4faacbebd7f7", "value": 637331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095487, "uuid": "92a008c1-c821-4122-8411-410037d88030", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095487, "uuid": "fdbbc754-b679-4019-93cc-aefb386ac3cc", "value": "Quotation 85663455.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cd558a-fe7e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1629110632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629110632, "uuid": "277c7870-0a26-4a80-8121-a2126ad15f5c", "comment": "Malware payload (Alien)", "value": "ea32dfb83dff2f55084a22624077dd6e", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629110632, "uuid": "9d17d2b9-1d70-400e-9746-27d79a749c19", "comment": "Malware payload (Alien)", "value": "9b288f10d587a1390b422e385e7813b24f51b34304ac0585242b865a7a1b9be6", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629110632, "uuid": "d079a13a-a8b0-4599-8a5f-40d581ff9cee", "comment": "Malware payload (Alien)", "value": "0b994725abc116f194007865b898e981f0b41e4d", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629110632, "uuid": "d730b899-2114-4495-b165-782683a67221", "comment": "Malware payload (Alien)", "value": "bd0bb6a9877ea3ebc6545ef83e099abb53a63e71a12ed58d4df3f8e471749bedffaab5a6eb35c866b9bd082bc6844c87", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629110632, "uuid": "629c8b9f-2bd6-4b4e-860c-b617b4d837c0", "value": "T1C5F5334FAB12C98EF53741B381B67156F271206990DA521F41330883A9EF9D8DFA6CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629110632, "uuid": "5ed8d33d-7b74-4046-9e8f-5b169f6c958d", "value": "49152:yzLDYLv2hd/i4QILkJWy2m74Hy7FBIsa9URW5cMs0UpmWQXAfhkw1eD:N2T/2jJLHvP894FMZU4WwAbsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629110632, "uuid": "0ee1061f-7f52-4871-b752-884227ace336", "value": 3522518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629110632, "uuid": "a87e9da9-e00d-4af0-a20d-c6177c1ad087", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629110632, "uuid": "a856c893-19ec-4577-8c6c-390978947de2", "value": "Android_Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93dbacf-feec-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629157850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157850, "uuid": "4b24e09c-2ecf-4226-a867-53dd1e9bda24", "comment": "Malware payload (RaccoonStealer)", "value": "a875620b019fdacc8a7ee2ce19d82ad9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157850, "uuid": "4764e2c3-cdba-40e2-8f6f-173e7b9278e9", "comment": "Malware payload (RaccoonStealer)", "value": "9bb77fb3b462b7b52694f0326b83b4f0f47969240e296129cd23da3b2fe98fb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157850, "uuid": "6fb837ce-2dcc-4362-a395-5b5eacc0cc13", "comment": "Malware payload (RaccoonStealer)", "value": "1c57f5242e42f536470ad82b56881f2fd6347987", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157850, "uuid": "78150cd0-76ce-429d-b94d-768c381dad6b", "comment": "Malware payload (RaccoonStealer)", "value": "dc6ca36c0d12357d70ae2e824af310edd483204de0f44127537d7fa45145ac60ac3243688a169f18bf2b35d92c2e29fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157850, "uuid": "c80bf2fc-bbb1-41da-92b8-0593ec4584c4", "value": "T158F533B26324F063C6AE087D526753300D5F6722F31E299FA6962CC9275A684D23D7F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157850, "uuid": "dd84f423-4ba1-479e-9149-9122981576a3", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157850, "uuid": "1eb1c98c-c0ed-4ae3-9ed3-8aa2d27cba9b", "value": "98304:J7ISOiGF7zsEtAU0o5g7rWCAfptaIjBlIgbBM4ocH7uTWRU:JDGFXsHMgmfvlB1F6cHqTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629157850, "uuid": "f4b70fc5-a54e-475b-98f2-df76d481b336", "value": 3476908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629157850, "uuid": "2f0703ba-5ce5-45fe-b002-4a0132f3b543", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157850, "uuid": "4fe4efaa-8e47-4395-90bb-0642eb1c7f1c", "value": "a875620b019fdacc8a7ee2ce19d82ad9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab35c1e2-fec3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629140190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140190, "uuid": "a7f58f35-6757-4dda-884f-e4ad71d153a8", "comment": "Malware payload (njrat)", "value": "707dc0aa9364e5d49f5b76d02babf27c", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140190, "uuid": "eca3d422-ef74-4688-86c8-85a6f6dde852", "comment": "Malware payload (njrat)", "value": "9bd7726cd18307f64b1646ff93474899b48c8873b511f96dd5e0f9634236115b", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140190, "uuid": "26d1350c-3f2f-46db-a5ea-1f72979007b6", "comment": "Malware payload (njrat)", "value": "8295c237d9ad75c08062619b218b4ea5d0ecd569", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140190, "uuid": "dbf1cec3-78c5-4f8d-a18d-ed77ce8892e1", "comment": "Malware payload (njrat)", "value": "dd871cd610232c11640a5c3347a012c1c4fe77415b06394f5d715d718836f9f621ec1b73050f3ee86051b40fe3192709", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140190, "uuid": "4ba87a5e-d0c6-4ce2-a4c6-ddbf2f29d490", "value": "T1AA318F04703319D3EA06D52231A731DDBD312708AAFB8B71145EDA52AA40DFF5C5CAB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140190, "uuid": "7225be31-be16-4f4a-a6ea-bc337a88c551", "value": "24:rEEPdqnWahNtJPpUI0I2rWGItUIZOIIIPITI3uFIJwIEIfILdgcjacdgcquU2b7v:3+dx2Ahn1wE+FIzhg3Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629140190, "uuid": "2fe0bb8e-562f-45b9-bbb1-860383e83809", "value": 1605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629140190, "uuid": "4aa9af23-2156-45b5-80fd-09d17fe39eb5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140190, "uuid": "d6337a08-e127-4573-837a-8aaebb7cf85d", "value": "Invoice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9941f667-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629134147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134147, "uuid": "1932e1c7-4364-49a6-8f8f-cc7423dadba4", "comment": "Malware payload (Smoke Loader)", "value": "c94018340455a7a77e490580f97b03aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134147, "uuid": "7bed1248-03cf-474a-ad29-f4c529ea8223", "comment": "Malware payload (Smoke Loader)", "value": "9bd82fd8e1933883024f5159f7b4d3c06609b98b7c4a07c1cb3fe76706cc2ce0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134147, "uuid": "4583dcda-7976-4394-b1f0-7ec34af0cdfc", "comment": "Malware payload (Smoke Loader)", "value": "80f4f7e514611024b75c6c5cce9b0c56f94e78d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134147, "uuid": "c448ed4d-7752-4ba7-a79a-5caa627afe3b", "comment": "Malware payload (Smoke Loader)", "value": "85ddae1674b92d16abeb0d5b64a759a259b772d29ffd879d2ddbfe03b0e2d802ba173596ca8d786cc40a280f82e9fd8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134147, "uuid": "6d515778-637d-49f0-903a-0630aff10d57", "value": "T1C004AE2D798FC072C3957130C4B38BAC4A79EFA0DA57057B2788356A6FB0EB05627359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134147, "uuid": "04463177-ad69-4227-84fc-75279201a8a2", "value": "894d0e2453b674d7fa4cc3ff89ddc063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134147, "uuid": "5da36b11-bda5-4f02-b355-2b6ceced14dc", "value": "3072:r+0L+WO/XP3zHGMfJUq7bikmCI5WBNBgRac/m+iI8ilZ7yP:fLon3zH57nikmz5qlc/m+98ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134147, "uuid": "6639ff4c-2fd3-4068-8b85-58947b2aa927", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134147, "uuid": "2b2a373c-a4b8-458d-8d84-1ae61834b317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134147, "uuid": "19cffbfe-5e15-4eb3-891a-d0fb69165d49", "value": "c94018340455a7a77e490580f97b03aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a5348d-fee8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629156044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156044, "uuid": "7d8d3ee5-652d-44c9-aca5-1ad88d7cc764", "comment": "Malware payload (Dridex)", "value": "0b145ea7233e54db781bf74ccb4cfc7b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156044, "uuid": "87d08b69-b03a-4a99-98e8-1617fa26a006", "comment": "Malware payload (Dridex)", "value": "9ccc1b32724b6561b1fe4b867984425ea4e981bf520d4b60f5bf86d6a66cdc20", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156044, "uuid": "7306ef29-9f5e-4a90-98b3-48e4b4767207", "comment": "Malware payload (Dridex)", "value": "91e461a9ab00099a9c15250dcd6d3e99835374d3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156044, "uuid": "36a404d2-4a6f-4f0f-a7d9-e2a2c8696c0b", "comment": "Malware payload (Dridex)", "value": "ac78e293a186851f48b95ce634a9ac63db5fa4e72e584c33ed6de5f49c79ea9f693988ad55b9135a3abef26da2eb203e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156044, "uuid": "ef8b1405-bf81-41c1-a2df-14b0edda186d", "value": "T19034021685B3E134F7CA60359C8A1FE9173A8F5F66D01B1AF2E1E31CAC07DE2215858B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156044, "uuid": "c922ba11-37a9-4a50-bb3f-0661801b5897", "value": "3072:SzAeN0RKSwCchO7e/1GrpdXx6sj848BqwhW8rWJz2fYblKbvus18O6nmY/Miilji:STNSLcq+YXEsHyvayfIKzusmnn/MS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629156044, "uuid": "cf1c57f5-22f0-4976-b0c4-303702b9be4f", "value": 253288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629156044, "uuid": "31ff934b-14b5-4b97-aab1-3726691d4327", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156044, "uuid": "af2ffa5c-0c82-45bb-bb5a-516071515abc", "value": "taxve_286664_20210816_0274639386_4291512157.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00494e5d-fed4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629147205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629147205, "uuid": "841282e2-464d-4634-844c-7497ab6e0e1d", "comment": "Malware payload (Dridex)", "value": "47957ff52712277a8b1a9035dbbe7df8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629147205, "uuid": "6ca92137-6f2b-4148-8185-a4c867b6cb1c", "comment": "Malware payload (Dridex)", "value": "9ceaf91454d9942ae311271e467f25f851fc5b69b1d3175626c755a1d207fa07", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629147205, "uuid": "9bdad9d0-415a-4901-b5e1-962009f3f5f4", "comment": "Malware payload (Dridex)", "value": "6d41687f1aeef1feeedc15040b32eb288f197265", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629147205, "uuid": "b8068fae-a69f-4b9a-89d4-1f540dd9eb10", "comment": "Malware payload (Dridex)", "value": "30e62d544eed2f8894731a83019d344b94a552ea38d8edabc5d1b615432f9dc0421518db7b0b2b8404fe10e3baac954b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629147205, "uuid": "bd42667d-9a75-4b98-b317-392bfe71f13f", "value": "T17C44F1046993E95CF95F7C7C9CDF19B86F9A8CAE08406A3F21E1E22CEAD43D72C14495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629147205, "uuid": "f7090a41-9cc3-492f-aa38-d434f97f5bb9", "value": "6144:SbtZbAPPimNA/kjoitk6fnna/8koOqegASELAY:2tZbAPDNAcMqfnnawO2O5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629147205, "uuid": "ff3becb1-0e7c-4b2e-bf08-8a2b5c5403e7", "value": 259647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629147205, "uuid": "34c4d66c-9ced-4651-b4e5-f7ca25784876", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629147205, "uuid": "065e0e7d-edee-4dd0-a8c0-f7b2e358880e", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_1_177190641.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9087c663-fe8a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629115664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115664, "uuid": "080fae21-c1c7-49b3-919f-2d7fb701e62e", "comment": "Malware payload (Formbook)", "value": "7a1ce3b14eee0f3768329dbb09ce36cd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115664, "uuid": "446dd67e-2619-456e-952f-f206a65f1a5d", "comment": "Malware payload (Formbook)", "value": "9d0762b171945af3415b28a64b11f85de56ae8b3ee141dec0ea07ff134ce1782", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115664, "uuid": "b9fa63ea-2a98-459f-a2ea-eecfbb4ce3e5", "comment": "Malware payload (Formbook)", "value": "8540d84e595a8c963b9e432ac42bed3dce105d41", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115664, "uuid": "1b4c2a41-eb9e-459f-991c-7dc0e839ea32", "comment": "Malware payload (Formbook)", "value": "7eb59fc0040f8a452c9cbab0dca1b2859348bcfc951c5323da1f4eceecc0cf5ab781d2ed1fb070db29ba7e8d6207778e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115664, "uuid": "6ba28f43-0f99-4e41-ae25-090643136b0e", "value": "T1E6451223AE894F68F4551F76E6D0A2DE56F8DF913100862EAB81B31B3D731F1898D81D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115664, "uuid": "7fc96cf9-b32c-40b6-bd05-e265a6cf5b21", "value": "24576:pePQqtQMs+w9TlyEdIqUu3tQXufjE23N1v8HY9hHp7T90PZvyPUxaeHz3iwb:pePPiJDdIqTtQ6jEqN1k49tExy8o0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629115664, "uuid": "5d5f93a9-27cd-4ea5-abb6-724f3656df5b", "value": 1277848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629115664, "uuid": "1763b929-4122-4da5-ba7e-f7112151e295", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115664, "uuid": "d11d6bf3-f7b9-4003-beac-61ee7744d7ac", "value": "shipping documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c7edca-feb4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629133635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133635, "uuid": "685c8e33-4e85-434e-951b-7a48fca8475d", "comment": "Malware payload (TrickBot)", "value": "e92d50f4349ca1a51784fa8155f699e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob122", "colour": "#D387A1", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133635, "uuid": "ce89408c-db66-4451-b783-0d8517c832a7", "comment": "Malware payload (TrickBot)", "value": "9dbffb4b069247648835fbdbc7ee71d467ee258a37b05797e83facfe53e61015", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob122", "colour": "#D387A1", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133635, "uuid": "914d76c1-8eaa-4775-a2b1-49a87292b944", "comment": "Malware payload (TrickBot)", "value": "bd10a2a6b0c1212ff697633cef5198eccde5413a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob122", "colour": "#D387A1", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133635, "uuid": "ba6acfc5-1b67-45ba-8685-8c00fa6fca81", "comment": "Malware payload (TrickBot)", "value": "527eb469712d3787406508062814a5096c5abad26b62bcea8309779b4b088422c01a7f1610d29b40ebfb2f5ce15cdb13", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob122", "colour": "#D387A1", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133635, "uuid": "6c36391b-7620-4f5f-99de-d3ac2c7627c6", "value": "T1B7158C02B6B5CC36C19A203F6A13A65512EFAD404EBAF187F797ABCD1A307817527347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133635, "uuid": "d4f4c256-a8be-49be-a8d2-01323acb1194", "value": "248f2d602d490233abbb095e760215c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133635, "uuid": "1eb08954-a16d-477a-8ea8-f9fa81cd03e8", "value": "12288:AB7O8YzAyMqsaVtvdWR6ZO9ikMVESyQHMsTcuUq6NMEdk:AB7pYUy3sGvtYOEpP7q6N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133635, "uuid": "634e9997-47ed-42e2-b0a9-e33c8929694a", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133635, "uuid": "46dc8415-1d84-4a6d-b28e-63d4e47028aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133635, "uuid": "3bded110-fbab-4f75-a4ca-296785c73695", "value": "2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a016d50f-fea9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629129005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129005, "uuid": "f13dd2ab-100e-4ab1-8ef5-028a313e8ce7", "comment": "Malware payload (Mirai)", "value": "16417482bbbc13a21430e6dfc80e0d86", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129005, "uuid": "f125cdbf-e215-480c-a284-236b4de91a32", "comment": "Malware payload (Mirai)", "value": "9e65cb87ceb25371877d19581c0c312b94f72de23b9830ef06d4bdd864ed3473", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129005, "uuid": "244c0988-d205-4c39-8fab-f5f2df572856", "comment": "Malware payload (Mirai)", "value": "3e3e1c764184b93fd8030de6b8d7cb3ae03aedba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129005, "uuid": "870cb0cb-944a-45b1-8d5b-1c0db6a4503f", "comment": "Malware payload (Mirai)", "value": "04bd726f575b34584f21ce5a3f0fe351aac2b0dace1144ff4b9af818aabd37b1557eda73b7b935ddc81f4370ea6ec882", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129005, "uuid": "532a1bba-c4be-482b-a1de-de7ca18e8927", "value": "T11FC33B46EB418B13C4D61775BAAF42493323EB54D3DB33069A185FB83F867AE4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129005, "uuid": "99fe8e78-505d-4252-bed9-40b499e3ac5b", "value": "3072:0slGp1lgHNEtxAJA672KrV0MaiF31M/9cf2:0slE1ldXAJA67troiFFM/9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629129005, "uuid": "21fdb35b-4f17-4d77-a7cd-d65b423207c2", "value": 120661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629129005, "uuid": "633a614c-e3a0-46af-b9d4-03ddf0416ac0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129005, "uuid": "a540e49e-a488-4cd3-9d96-23ad376a1204", "value": "yeeted.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7bd78f-fe54-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629092280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629092280, "uuid": "fbafc776-2122-43ad-80bd-3fb507c3bcb9", "comment": "Malware payload (RedLineStealer)", "value": "efb3e6929403a295ee9f8a0dfcdd591c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629092280, "uuid": "4a3fbf70-fcea-4f1f-b0e4-e89475036f87", "comment": "Malware payload (RedLineStealer)", "value": "9fe6d5f26dd379278e64d52d402e4e818384998d224fe8ff6c1c25a9474321e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629092280, "uuid": "fa2f714c-04e7-433a-b6c1-3204e95b39d2", "comment": "Malware payload (RedLineStealer)", "value": "5ddf1ddbd09ff05e03d914a6c90189a7acbea0be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629092280, "uuid": "0769514a-7db8-404a-a333-21f5ec836380", "comment": "Malware payload (RedLineStealer)", "value": "ba1e6b36a0faf16683a23b4cd9145927e355aa09fd66a1420c93487963e4b4121ced746377daf8577bbae7cd3172da3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629092280, "uuid": "410b7f5f-1ca7-490a-8522-5e56dd48b5f2", "value": "T11F367DFD369EB2DFE44A29B4D056ED03471D13F34A50C84AEDACB87DAB13C85059AB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629092280, "uuid": "02352c13-ee58-4010-996d-9503b7469171", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629092280, "uuid": "0cdacd8a-84eb-4ba2-80b1-26b9a377d56f", "value": "98304:Hkuq5M/9s/DtYTVmpnT7p6qvq5JFhJ3+0Uuh:HkuqiabtY8xq5T+0bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629092280, "uuid": "5c708fc9-2ee1-4346-a1a8-6d2bbc920979", "value": 5071528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629092280, "uuid": "724e5886-040d-4953-a6d9-fc90a082cc6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629092280, "uuid": "99ab84ed-8e49-47fb-844a-1c6376df2586", "value": "efb3e6929403a295ee9f8a0dfcdd591c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dfa5d4-fea8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629128500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128500, "uuid": "1bdac108-2516-4533-9ef6-584760182632", "comment": "Malware payload (Dridex)", "value": "8b7e0f756bea5128e7e714ed8ac81d0b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128500, "uuid": "fb7cadd7-0478-43a0-8e24-4904759afeaf", "comment": "Malware payload (Dridex)", "value": "a1534ce33a2ff3ab50f0fa207467550b0f8126befdc4fc82034e4f46d807dde2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128500, "uuid": "119dab70-7621-4339-b231-641c8a806562", "comment": "Malware payload (Dridex)", "value": "a70ee44cc959fece6c3393fb6b460f6828d8a6ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128500, "uuid": "276d3dba-90f9-4533-a5f1-b94be5e905dd", "comment": "Malware payload (Dridex)", "value": "52e0714c1dca715e96be28f5ff721b870a58bd74e0de01629d64464ee2e92365b709cd7b8aa80dcf88a150c9686809f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128500, "uuid": "4fc19d55-0f0f-4cb5-92b7-23b3eb5e7371", "value": "T16604E18CE48B6107E52B6678431CFB2614C4AD5C56F2CB5CAA41C27EF0B7E3994B0B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128500, "uuid": "2ac7b9b6-83a4-40f3-a531-30bfe8d24fc6", "value": "07a08e3e316eca8e37df205ff5246906", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128500, "uuid": "cf5350cb-20e9-42bd-8645-4c84bb127b09", "value": "3072:iqJs2vTNBtg6SSiP2uPGub071f8eWdwBIZ2qSeOVg2f0LhSLl84aci2+e2f2:iqbNfaScP47aeWdWqgj0LI8zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629128500, "uuid": "89cdc550-a6ca-4700-b157-9f722d55c2ab", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629128500, "uuid": "18009ed4-07cd-4ca3-9661-18533456fefc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128500, "uuid": "4f7e7403-6f5a-4d54-845f-0fe963370a9c", "value": "8b7e0f756bea5128e7e714ed8ac81d0b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a28e500-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629104863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104863, "uuid": "271f7294-6c8c-47e9-b311-4226391d8df7", "comment": "Malware payload (DanaBot)", "value": "24f468bac70eb93701a9a06511ab3a0a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104863, "uuid": "e5de2461-1e01-484d-b877-7334016c1072", "comment": "Malware payload (DanaBot)", "value": "a1f96baa1a0ebb70d164d060384b169c5bab3b1d8f1d23e3136ffc3eeb0bfbd6", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104863, "uuid": "46ddb8ea-57b2-4079-babc-3daf788d10e4", "comment": "Malware payload (DanaBot)", "value": "3d4dfee85e6b4fd8c94ecd2b064c345d8e639913", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104863, "uuid": "ec4fe9f2-fa56-42ff-ac2a-5f70f3ad3b8d", "comment": "Malware payload (DanaBot)", "value": "02ceccaf2d81f272562c18ad14ac85307cd9fb8619f0a33deca38c01fb5fc802bd922a3c85d42f97fe55112802a57403", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104863, "uuid": "b12c62b8-6558-4b15-953a-325191c7f26f", "value": "T1B135231E714FE071C7923571003B8B9C1A3DAF42D627503B678464AEAE74EF2897632A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104863, "uuid": "222a83bd-1cb0-4f9d-8e09-20fc652fd875", "value": "b6eb307a53194f1a2629d22afffc5564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104863, "uuid": "ae79ab50-066e-45ad-90e6-a93a8c58c589", "value": "24576:tAXcvwLgX9LcKELH3MvXVk2yuPx+ntoxl5yG8:iMoLgX9LzELH8v62ygIntul6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104863, "uuid": "1f8d7756-9b34-4121-828e-90b721bca6e1", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104863, "uuid": "67b5a3c7-06c1-4308-bcb1-d1892b6ad099", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104863, "uuid": "0c93cead-cebc-47db-8637-68132e0b9a50", "value": "24f468bac70eb93701a9a06511ab3a0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221299c4-feca-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629142967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142967, "uuid": "b9a5bc97-92dd-40ae-b253-26ac03b00a1f", "comment": "Malware payload (Dridex)", "value": "ad9620b98d697b603f0c3ec4e618e4d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142967, "uuid": "31a71046-9b62-40f5-8922-d70a4cbbfd1b", "comment": "Malware payload (Dridex)", "value": "a2c0961c68aa8ec95213014e570ae11abe0ee633670c676b43914bd3c4b8ce52", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142967, "uuid": "f717ca10-b7f9-4fb1-940f-f5cf9a89c205", "comment": "Malware payload (Dridex)", "value": "7f7c8a54cbac1207f6a936fd174fba71db8b4be1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142967, "uuid": "6db2ad1b-775b-4565-9d9c-a986c842bcb2", "comment": "Malware payload (Dridex)", "value": "fb423386b009cc8842e1280bd7f404314a2cab63264707b9540ab737aa9cad2f1ea6f984972eb0587f078b632e81847b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142967, "uuid": "4e34cad6-4ef8-4e52-a704-f0350585206b", "value": "T12934011A9677F270DA82A03E4C8A9FEE27B08F3F04905307F5D5A35DAE09DD71251987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142967, "uuid": "94147459-ec90-4258-968a-8d7d2e9a38b5", "value": "6144:S4NSLcq+YXEsJZ0cSd3ipzX7DdXrW9c/qT:bPYXEsnSp+pCQqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629142967, "uuid": "15d840a4-d22a-4ed7-8287-8da80bd15df8", "value": 243307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629142967, "uuid": "5dde2aea-9c54-4ea1-b1d4-87cbc0b19e81", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142967, "uuid": "bdd572b4-2ebc-4780-978b-25548a50dc0d", "value": "taxve_375998_20210816_03999618_293346622.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a099b6a-fe5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629095387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095387, "uuid": "2eb66a73-7229-4179-a72d-a04b793925bb", "comment": "Malware payload (GuLoader)", "value": "4693614f943df9eac87501b0ba00d6fc", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095387, "uuid": "4cf958b3-ff05-40f0-875b-83aab7345f90", "comment": "Malware payload (GuLoader)", "value": "a3e2d5013b80cd2346e37460753eca4a4fec3a7941586cc26e049a463277562e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095387, "uuid": "d5c37799-3967-490b-92c5-de81e48d732b", "comment": "Malware payload (GuLoader)", "value": "d1a6e17c78d1003e88824cab1cb380340816d6c1", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095387, "uuid": "b4a56965-7287-4ab2-a96e-9470f6e51ac0", "comment": "Malware payload (GuLoader)", "value": "a346fe8f29309d630e4f3a21d8c2a097bc1f7f377afd82b2fb86b172d910abd79ebb0ae470a1317300252bf154e2e402", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095387, "uuid": "a120ffdf-0a16-40a4-bcfb-925372f15cb7", "value": "T1DC43020F1954E974C06E3A06C77138A0A2ED185A378BB330831435D6B6BC7C0EB9372E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095387, "uuid": "ba53bffc-c734-43f0-84b2-f92218d3cf7c", "value": "1536:Eqdk8/N/+sXDCmAFenuO6R9s37v+LLGofxin:Eqk8J3xAFSula37YLl8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095387, "uuid": "16a4aa08-6538-4dde-a11a-20d52894e2ef", "value": 60624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095387, "uuid": "d2873593-4db2-4661-a19d-d9f2df47962f", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095387, "uuid": "a01332ff-afa8-4508-873f-a1faad771ef6", "value": "Abu Dhabi EM SHERIF CAFE WEST BAY Attached Equipment Schedule and Drawing for your reference.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d647794-fea1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629125564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125564, "uuid": "a94f1915-eeb5-4286-95e9-328ed172cfc1", "comment": "Malware payload (AgentTesla)", "value": "861b73a12bd5354169791fffc4bb4679", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125564, "uuid": "8b653062-3eb3-474d-9b6f-48f36a288128", "comment": "Malware payload (AgentTesla)", "value": "a3e6ddf936423f35ad131abf8cefe5c2596b6a82b467f42449005e67b68054d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125564, "uuid": "3d975ff4-d13f-4731-97e5-ac8deeb020ed", "comment": "Malware payload (AgentTesla)", "value": "39563b14efa22e5145f6af80dc90b0c03f62e3b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125564, "uuid": "f3d72f1f-79ae-4e54-83e7-4409600292ee", "comment": "Malware payload (AgentTesla)", "value": "a02a080039e41dc880f8217918cbcc53f1904b3187d1f8ada61ee1e9952064fdd243b12e1d62fbcd30d9e97b872ca2ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125564, "uuid": "68e8dc3d-2881-4e8e-9571-36a038a30128", "value": "T1D615E0657AC1ABCEC23A4EB5CC017400DBF1E2776607EFCB2CE615D85A5E6850A3325E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125564, "uuid": "33599478-be4d-497f-be69-054e1c7401b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125564, "uuid": "ba63e300-66be-43c5-8efd-1a31a41882b1", "value": "24576:49SLSz3dUOkHptjzIF9KymAn+Q12m+3CaMnWPzQDeINup5D5GT0+:cGCduHptjzIFYyxf125CWPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125564, "uuid": "ab26fd40-0d89-498a-9cb8-14496acd5b6d", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125564, "uuid": "74d36d6e-ca93-481f-9dba-93c43e2611dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125564, "uuid": "21712224-b39b-4b9e-bdb7-9ca44efd4401", "value": "L-21-10737 QUOTATION - EX-WORKS SINGAPORE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae410f30-fe8b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629116144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116144, "uuid": "61943fe8-a0a6-407d-b684-0018f56a8de1", "comment": "Malware payload (RaccoonStealer)", "value": "fa5832dd51887a1b02c0ec71fc4b69b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116144, "uuid": "2a809926-3e7d-4af7-a4ac-bcc083eded84", "comment": "Malware payload (RaccoonStealer)", "value": "a5316932344a3c83e2e2bddb6cb19d73ce03fc820c20a573d5e7866071a84a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116144, "uuid": "bc2cd43a-56d6-4539-b904-4b107df25839", "comment": "Malware payload (RaccoonStealer)", "value": "4465429197dae92d5bcf35148cbcd5087a360c03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116144, "uuid": "90f0c9f3-cc9d-485b-8802-4faeeeb56506", "comment": "Malware payload (RaccoonStealer)", "value": "6f102ed0fc89bdcf683432d451b4d87132b3923b672561e05aaef40def500f87baf8cd5e457bc2f2a77227ab3765411c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116144, "uuid": "18b19644-de02-490f-b887-d1dc2f31186c", "value": "T1FFA4025D368FC532C3833430E477C79D09A9ABA1CA97007B27495EAFAE70EF11669349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116144, "uuid": "917d74a7-8d46-4f84-b544-603f55383bd4", "value": "dafc106ac3cf797fb47a900898f7a792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116144, "uuid": "a1f338ee-5d1d-442d-a616-cf311c039ce5", "value": "6144:A4LNygs0VEb1n4nHPtoNQr/d8P96yqNHi1b57eAiQXaOr3pEY5zyi0aVKdx/O8b9:dBygDCb1naGTPtb1eXLY5zQdpOYztWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629116144, "uuid": "3abf4af0-8212-49fb-a8d0-2a186248c88c", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629116144, "uuid": "9e63f2a8-ca20-4f34-a74c-be83f72ed5b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116144, "uuid": "19719a7f-36a1-4785-9dc2-a186b093b51a", "value": "fa5832dd51887a1b02c0ec71fc4b69b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c8fd55-fe76-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629107026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107026, "uuid": "0b7d27a7-9989-4c72-bb83-de40b8c6db19", "comment": "Malware payload (Formbook)", "value": "c8f7096833654a62280f5897fccfde65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107026, "uuid": "b1a3c224-bcbe-40ae-a99d-8658fc6d84ab", "comment": "Malware payload (Formbook)", "value": "a53a4c82477eada893191662cf4ab4b3f44d1da7cae9ea8a7de3f859a424292b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107026, "uuid": "69998249-fb83-488c-8fb1-9080a7060fff", "comment": "Malware payload (Formbook)", "value": "c57dbed8e46b6ded603d67294d2e159bfe90b1ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107026, "uuid": "08c38ba6-7e84-40e8-9eea-765bdecee0a0", "comment": "Malware payload (Formbook)", "value": "44df5cf7c0d57e811ae6f49befeeac9c90128f691fb0c0260f518f0c2525e053fba9e722281ec3e2f5ffc1802bc737b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107026, "uuid": "fe872c02-11ec-4029-abba-745a8b13f0ac", "value": "T1DF05CFB071A78696F51F4A742578BD5403B131F3A9C6DA391B1A604ACFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107026, "uuid": "2dc20204-2a63-4a39-b34d-8f7c8fe936ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107026, "uuid": "56c97c96-5ad8-4b6d-b4c2-bb149e70eead", "value": "12288:sVfa9KTfDpfZ5subXEWAKKsQ3PnMEP2gp0S5JOEPpBja:Y0KTf1LLXEWAKKdnME+L6HPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629107026, "uuid": "4aeb7401-8c47-4dc0-8b8e-55a408c95ddb", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629107026, "uuid": "cdf4e49d-59fa-474b-8a18-66e2934aa50f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107026, "uuid": "9b7cdbb3-f384-4876-99e8-cb1aaee3da65", "value": "c8f7096833654a62280f5897fccfde65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037532b1-fea8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629128313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128313, "uuid": "8189e2a5-3c21-48a5-9206-405ee8d0309a", "comment": "Malware payload (Smoke Loader)", "value": "0c40f86ba80595183792c3447017bc2e", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128313, "uuid": "d89fa430-cae3-4ec5-b282-2ca6a8efbe3a", "comment": "Malware payload (Smoke Loader)", "value": "a579df463934b191934477803f2045e998e3acca5932492eb4a090cc8857182a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128313, "uuid": "1104ba8f-0405-4df1-80bd-8d81de315e11", "comment": "Malware payload (Smoke Loader)", "value": "a6cbd342df7946085744bd899980f4028c2a63e7", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128313, "uuid": "c938ae48-9158-4b5e-9bab-dcb9a53c45ab", "comment": "Malware payload (Smoke Loader)", "value": "b6677b61fdf5f41ef95ae9e03caaf1ffaa7f857069c16793d86d51f41373f6352d5a39d49fd1e457e74144d2516e5f60", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128313, "uuid": "96a443c5-38ce-4077-9134-410b5610fdc7", "value": "T1E214D0127750D5B3D5A5407040A2FBE0AA68FDB2E660756B3F982A6F1F303D0577B38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128313, "uuid": "a977b95d-3a4a-456d-be1c-a431e0c5bb43", "value": "32eca4427f106c548c06ec4f87d7efd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128313, "uuid": "2c967284-e088-4712-834d-5d5d139c01ee", "value": "3072:hnO59tSR4OMhPZei71ukaPytBN8nRUQuKT0yB3RjYaLTSWj:hhRIRLpfcl1YQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629128313, "uuid": "92eb5eee-a27d-44b3-9df3-981a77612630", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629128313, "uuid": "5f02698c-c1b1-4c8c-8f54-2e9efe05b163", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128313, "uuid": "dda173d9-21c5-4d07-a189-558ed8c4c848", "value": "0c40f86ba80595183792c3447017bc2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2106b5d-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629126082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126082, "uuid": "7b79501a-b2a7-4d0e-b474-eddc8ce28248", "comment": "Malware payload (AgentTesla)", "value": "4c97db607121599d29a2a074c7c43a85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126082, "uuid": "c2bcb428-2466-4f36-a9dd-5c9986af7b95", "comment": "Malware payload (AgentTesla)", "value": "a67e658351bb43926150db1f38edd9cf28ca56adba856d195ff322609fdc55b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126082, "uuid": "667718d9-901e-4afb-b355-8509cf40dd19", "comment": "Malware payload (AgentTesla)", "value": "52979f1c01bbffc377b9f458fe942ef7592b82da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126082, "uuid": "9837178d-9bf1-44ce-91ef-3fc79bfd225c", "comment": "Malware payload (AgentTesla)", "value": "83ee04143cc53c5f4a2d9f5b2b5df7814b18bfcf2f46ce2b843e71a6e7b57b42c7d83bb9555b578a091f42e1c9873386", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126082, "uuid": "fd0a6ded-d114-4cc7-8997-ac5f71530d11", "value": "T19CA302115B7BD97AC8F61F7BADB3232103FFA9624560EB1E369C50860C827911663B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126082, "uuid": "22f252c7-7097-4991-abd7-26b64fd8cc5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126082, "uuid": "358f1910-6e53-47ed-975f-b0edda815770", "value": "3072:yRm1MLanhLB7XqSl9Q8IGuSdjnOiRs3/3pEPoLFM9:tnpld/BnlE0QF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126082, "uuid": "ad088dc8-4d0d-4123-95ff-c4d0e8e29b6a", "value": 101888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126082, "uuid": "2cf31efd-af5c-4f35-afa7-dfcbfa88c0bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126082, "uuid": "f6276ed2-bf3e-4318-9bd7-56c456a6de89", "value": "Remittance Advice (0010063372) O16 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd7204d-fe8c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629116442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116442, "uuid": "16765366-da46-4c96-b6cc-e4738ad5ad59", "comment": "Malware payload (RedLineStealer)", "value": "79f4d12e961a0bd3ed1d2bc65c284084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116442, "uuid": "1fd6eafa-cd88-41c8-b95e-107281b65019", "comment": "Malware payload (RedLineStealer)", "value": "a69ac7a1e304a95cfa390b933ced6eafd0f8953d658f66466f1594e1efdb2b1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116442, "uuid": "c3dd2db4-d5fc-4609-9272-0070bdbe4e72", "comment": "Malware payload (RedLineStealer)", "value": "5a1f4fc6b16c126c8d4f2f2f82d474272f4e104a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629116442, "uuid": "57cc4136-55ce-45b8-a7e9-45cc6a1923d0", "comment": "Malware payload (RedLineStealer)", "value": "d37ad1eeb3e8d8c78f1f59f3b69fd29ffd4d1d0d9f3081dc01181bcfb577977ab4cbf7a84e218ab1a5abf5082ccd1b43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116442, "uuid": "297cbf73-abd8-4758-a461-df886a875843", "value": "T17FC3E6A2132C8877C0872530F0721B17E5578F9E168BF289FE2DF19A986D24D74B7356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116442, "uuid": "ff7109ef-ceb2-4abf-a120-7339866eb0a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116442, "uuid": "551b92d3-9e5d-42d6-bcab-b8753aaf1ead", "value": "1536:5Dcs8BL9yLHxbt5tAH3Ybh5p4aehvmqHyBs:5t8BL9wRbmHazBehvmqHyBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629116442, "uuid": "3ce2a4f0-3938-4c8a-909c-6c43b8be2aad", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629116442, "uuid": "1f53af8e-b614-4af2-a0de-b140b023ed30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629116442, "uuid": "9a025eff-4912-4753-97d8-86b231d785d5", "value": "79f4d12e961a0bd3ed1d2bc65c284084.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26331067-feb9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629135672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135672, "uuid": "c01c4f01-afe8-4117-90a0-c9c6802aa6d0", "comment": "Malware payload (Loki)", "value": "65715e10ea8ea3f0944fa0d4f7769266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135672, "uuid": "ffcd2e1e-0577-4f93-bd9d-93af3587fa9c", "comment": "Malware payload (Loki)", "value": "a6ebe80f6fefcf709347f986ff5c913d0be43d98b693f18c363a2d4293d5c17a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135672, "uuid": "4e4b92d2-69b6-4200-9334-5ccb741ac66b", "comment": "Malware payload (Loki)", "value": "e99fb439022d9c2ad1102ee67c624211b8131eb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135672, "uuid": "d83fb344-497d-469a-a99b-99f1b0295691", "comment": "Malware payload (Loki)", "value": "27c6cba283c7f2471501c3e1c60a4678b4631463fc30eee2a348d1bb2ab28a0428f9f893c62bebe4d5a7e3bd7b0cb751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135672, "uuid": "7b5d8cc9-e2a7-4643-9a82-c0e77efa43fe", "value": "T132D43A7C3150B9AFD13BCD36C4580E55F660A8A7A3CBC613E0932559993D3AB9E402BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135672, "uuid": "06c5c274-e23a-4193-a787-1b80ea030fa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135672, "uuid": "c79f3973-eff4-43e7-83c8-f287768505bb", "value": "12288:52ehxTgVSQvHt3H4aN/KOj8ncPHHg1qJOwyRtiQQ7:5nnMVSQfBH4alT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629135672, "uuid": "0c7f77cd-6dd8-42b5-92d5-5dc54a7d38a8", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629135672, "uuid": "5d43f0d5-3564-4d09-8ced-afb94f77c992", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135672, "uuid": "36d7d9e4-39e5-4f4c-bb90-18c9efa464e9", "value": "feKIyfpdldOh6iN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758c54ae-fe5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629095433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095433, "uuid": "8abbe641-d90e-48ed-9d8b-9ab47f677c88", "comment": "Malware payload", "value": "7c801e3c256d2e9e1f4462fe84e44c68", "object_relation": "md5", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095433, "uuid": "d9d948ad-f42a-4343-8185-e5e6904f6067", "comment": "Malware payload", "value": "a7cf0f72bb6f1e0a61fbf39e3a3a36db6540250caeef35b47fb51a8959f40984", "object_relation": "sha256", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095433, "uuid": "1213c7f3-2624-4bb5-930a-217050675191", "comment": "Malware payload", "value": "4cd9cecd1d093f290e6f8f0ad6d5e76dbedbf3d9", "object_relation": "sha1", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095433, "uuid": "cc2a2ead-06dd-4abd-9048-a6a87427c295", "comment": "Malware payload", "value": "ada739cb6e868ca91f707eb8c17e0f17e746b254e197fbb2d93f74bb3efd1a183ceb0dc0968a52145ae060c3b646e0c2", "object_relation": "sha3-384", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095433, "uuid": "4d072b32-d2f5-47ba-8488-511e0dcf4632", "value": "T189F2A443E5AE50D6D8B9C036B567763BFCF17D964138AB3AAA904B1B0723A30F51E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095433, "uuid": "40087ba8-bcf1-4626-8a82-cf5bdf652d64", "value": "9f86f12427bca134faaa21bcc0d849d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095433, "uuid": "5145a7b7-aab4-45d5-b8cd-66befb345614", "value": "768:vkcGOqEMccVhPO4TrASVqipOHMd6m/YFh50:ccGOqEMccV7rAZipOHA/YFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095433, "uuid": "7f1dc91a-5a71-45d3-9d3e-32965a1b28ed", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095433, "uuid": "b0dde8c6-625d-4c1a-81d7-d3b8b405b339", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095433, "uuid": "dfa5e01a-6b89-48f4-b973-2f0fbff5e2bd", "value": "a7cf0f72bb6f1e0a61fbf39e3a3a36db6540250caeef35b47fb51a8959f40984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8684fa7b-feed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629158168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158168, "uuid": "96145e7b-2f5e-413f-b3b1-8b148749ff25", "comment": "Malware payload (Dridex)", "value": "4a328df0576e04edfb37e638b98f67dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158168, "uuid": "f11208a5-7060-4a03-b1f3-81699d8ebec1", "comment": "Malware payload (Dridex)", "value": "a90a7ba282e0b3615b84c9668dc6c89e354e5338299367d5aac226dae6573ff7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158168, "uuid": "c5d0686b-82fb-4615-9e62-a7ecf4b049be", "comment": "Malware payload (Dridex)", "value": "28f27b7dcb150b43648c9474d3e175eb7b92a60d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158168, "uuid": "4e824117-1d6a-4a27-92a8-498dc57d5f97", "comment": "Malware payload (Dridex)", "value": "48b78a0a193abbad13cb5cee18dbaba6e7f34a58a2e65ff2a6da4a6e1852f88686b9d6ae02e86f86c3d9c5c5e5379d80", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629158168, "uuid": "40b051a0-be10-4546-bced-16b424e2b2a4", "value": "T1A834023BEA589E53D91DCFBE6D1A2AB01383E002D315F0C859D19EBE2B6947207E570D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629158168, "uuid": "0bb7083b-3a99-45d6-967c-8f97d9e244ee", "value": "6144:6ogkLjLhkxkE+K4xv0FfqWZrKyHJ4LsQpco:DDLZkjyxv0lrKMZO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629158168, "uuid": "554980a8-a505-4eab-9c74-8ca94d5fe740", "value": 252063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629158168, "uuid": "f0292d7e-8207-4d43-ac2e-5161dd169c16", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629158168, "uuid": "881720c0-6717-401b-adc8-8dd089dbb552", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.8065624113.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca45693-fed1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629146152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146152, "uuid": "3ea1553f-48fe-41a8-9078-58f3641ba254", "comment": "Malware payload (Dridex)", "value": "e96ed489147a60a9cf8b23bf3554bc26", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146152, "uuid": "c64d7382-e71a-4f82-9405-c995b71aa4a6", "comment": "Malware payload (Dridex)", "value": "ac663c0545d5daeda1f41385ec42e65e109e0557d75cfc9addd00c7453c8a2f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146152, "uuid": "e54e6c04-6bd1-4619-9903-0904359ede27", "comment": "Malware payload (Dridex)", "value": "a56e6ec51ff2112f247c01793ea3532b7ec9336a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146152, "uuid": "f6647fc8-bc80-4dbb-8dba-d76c02b39066", "comment": "Malware payload (Dridex)", "value": "384e0fb1a374c5aee4eba2be3ec98a7938a586488a611499949fd73c0a6f140812ab6b565bb7457401dcb74a875064ae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146152, "uuid": "17a3b938-6de2-4a83-bd34-470a64a6c134", "value": "T1CA4401406893EA0DFD4F7D3C4CCE24745FCECDAE050429AF66A0E52CE6D86E31D6A586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146152, "uuid": "1c55d439-0b04-4092-9ace-5a9358ce91eb", "value": "6144:SUtZbAPPimNA/kjoitk03H7Su6tcJch8KKSy+ddlO1et7sL:JtZbAPDNAcME37+tc2h8vP8dltpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629146152, "uuid": "23166cf7-48f0-4f99-830d-4d69314805dc", "value": 277579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629146152, "uuid": "b92b4674-b68e-4d30-ae18-17773f2966ed", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146152, "uuid": "19a6cec5-7cd1-4e58-9a03-be82f30455dc", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_6_928809.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc9c4f0-fea8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629128382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128382, "uuid": "dd02b50b-b242-4494-9c4a-3ad0d684e53f", "comment": "Malware payload (Mirai)", "value": "cdde8cd6bf4a8406fa60fce31eae324f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128382, "uuid": "4551f3bd-b5fa-4e91-aa8a-e6a67c7a6918", "comment": "Malware payload (Mirai)", "value": "ac95803a8fd46791b87cb2d3cc05dfa4afbb34aa831d6cbbfe098e9400233c81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128382, "uuid": "540ad8c0-b6af-4ce5-b93f-71b92b2146a2", "comment": "Malware payload (Mirai)", "value": "f749a1e6b434d6035a24f13753183bbc29b7edfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128382, "uuid": "efcdb547-bc31-41d7-ad32-638f34d7b5b4", "comment": "Malware payload (Mirai)", "value": "aa870bd9edcf71f6001bbc774f5aa7b1c8dd6a5f2b88f390a714f2d8616a30f2fe2e1c54394f4869d9ada8eb17d0aa1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128382, "uuid": "6d3626dd-f8ec-4d7f-8ff4-11160fd965f0", "value": "T17C430A46B991CF11C9D413BAFE1E118D33136768E2DF73129E106F247B8A96B0E3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128382, "uuid": "42d2a14b-ed29-4a7b-b8b3-54efc28df8ba", "value": "1536:6cnbUg6zMQrC3D1/hS08wrlau6QgBVPpIdi//3fvCg:ozMW4phSSrlc/3fvCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629128382, "uuid": "0ef09c7a-d217-47fc-a35a-29a6a5b7f6b8", "value": 58168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629128382, "uuid": "50832bf1-eefd-461f-8b2a-efddbe073a79", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128382, "uuid": "e1b314d3-081b-4b51-a7cd-50e75f4d632d", "value": "cdde8cd6bf4a8406fa60fce31eae324f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8276110e-feae-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629131103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629131103, "uuid": "cf2421ee-ba8c-4271-b968-0d1e448a8c8c", "comment": "Malware payload (Dridex)", "value": "0bb0dda136e228b9c0721c0489ae935a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629131103, "uuid": "1e615941-25ea-4634-94e5-f4e4191937b8", "comment": "Malware payload (Dridex)", "value": "acd2b61b1fd4f57688a846ee37628b9b50b8af0c8cf314e53eff299f09fcc320", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629131103, "uuid": "a7e76650-c2c8-4e5a-b46c-349ca4f6db63", "comment": "Malware payload (Dridex)", "value": "b404997524b3775e0041e6c5c3555c60cbff9505", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629131103, "uuid": "01a0fe1b-705e-4afe-9df5-4078a44ea332", "comment": "Malware payload (Dridex)", "value": "19c662cfe01d69e528c4d2c035f310783b88ec6cb6c27dcc761a2bc358e1cd8707851014e477cc970641c43f5fe13bc6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629131103, "uuid": "7f331ebb-3966-4f89-81cf-73ea2a20febc", "value": "T14C44F1516AA3D96CFECF7D7C8CEF24B46F9E8CAE1580A82F21F4A54CE6E07852C15444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629131103, "uuid": "7aba7155-f61d-4887-8fd6-4bd359e1e31b", "value": "6144:SbtZbAPPimNA/kjoitkbYNn9Ztx3oe3q6irpbXmLasDK:qtZbAPDNAcMLS9qe3q/pbXmLayK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629131103, "uuid": "aa4b6673-92d5-4623-a39d-8ade982690e6", "value": 253906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629131103, "uuid": "33d3ff26-ba47-432d-ab23-34108c72bb9d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629131103, "uuid": "ab11726f-6e18-4846-9991-3e35a2d6f38b", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_5_10034539.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6952d0-fee7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629155413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155413, "uuid": "2f64ca03-7550-4773-befb-860d126465c5", "comment": "Malware payload (Dridex)", "value": "17ad1c74c1fae45be7af43b1954098a9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155413, "uuid": "d53c83c6-a5f8-4629-a3d2-8d26bc55bc36", "comment": "Malware payload (Dridex)", "value": "ad78d481714c89b317e747c8f5b9f9908b1709f8d46e6d5744d3acde75fd3298", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155413, "uuid": "51b68214-e624-400a-acf5-244db2fd82f5", "comment": "Malware payload (Dridex)", "value": "4ecafc2b7b4c6b740e6329429365c9087bb590bd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155413, "uuid": "bb4c0c66-51c2-42d4-a0fb-f92314ae43dc", "comment": "Malware payload (Dridex)", "value": "ded90c6af61fc00132424ee89c3512b80128cdb0a71674eb6e60b8a51d6e6a19421e7408bd095e4b7512bc375d2aa244", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629155413, "uuid": "8c5e46ec-3184-4bc0-babe-cf3fcde29476", "value": "T13034021984FAF115EA6BA47A4CDE0FE513B44F6F01E05B17F6E6E00DEE18EF6119018A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629155413, "uuid": "dd6adb17-2cf7-43ad-b335-493b9ea29450", "value": "3072:SeAeN0RKSwCchO7e/1GrpdXx6sj848bcbgvFkajf0weVNPbSKTNM6HTHyCUhkGJY:SyNSLcq+YXEs9bgVsBHTSCUW2Bp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629155413, "uuid": "a337f809-21c3-440c-9d80-f7314e104c49", "value": 243902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629155413, "uuid": "087f0165-f400-4516-8aea-c8c4329845ed", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629155413, "uuid": "099aa140-44c1-4baf-91c5-3e64754a5157", "value": "taxve_7464344_20210816_468308_958117.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006f9695-feaf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629131314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629131314, "uuid": "18632222-8020-4d86-b7f2-2ba599af8822", "comment": "Malware payload (Dridex)", "value": "f0741524a977fd80aa2afa476f7d97a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629131314, "uuid": "d2a0daa7-719a-490a-b0b6-aa4b1666052a", "comment": "Malware payload (Dridex)", "value": "ae11863eeb02ce9ef4581ac2d3753711823a815605d290350f594023ba648886", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629131314, "uuid": "b7afd2c2-143f-4830-921f-33f4096eadf4", "comment": "Malware payload (Dridex)", "value": "655e610cc4240a3d1704ffbd95ae6cbf470fb364", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629131314, "uuid": "a020f4d5-bc8e-4d9e-9227-31050f9031ab", "comment": "Malware payload (Dridex)", "value": "56965a28a20c3b47f53b72ab32f49ae84d6fe425a1dc37b9c7e1339c85fdf8f4e1e37e3ec3377b1c441eacd9c4385bea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629131314, "uuid": "626f1c18-9ef3-4ecc-a420-263e0f0bba74", "value": "T11D640159AA67F86CFE4F7D7C8C9F20B02F8DCDAD1508693F2291A529EAF02E15D11047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629131314, "uuid": "ea5b07b3-5fe1-425c-bc68-ce4fc26cdc46", "value": "6144:S1CxtZbAPPimNA/kjoitk8r3B691niYam4DUCcXllf9HcPoNj50eMN/w5PgA:uOtZbAPDNAcMMroVa7BcrfRcPzN/w5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629131314, "uuid": "58e906f5-e918-40be-b9f6-56454f9d0526", "value": 324331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629131314, "uuid": "341be950-3e39-4941-bbe7-54420f3e11c4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629131314, "uuid": "712004f1-b69c-48ec-be23-447a51e6987a", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_3_652499.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f850eb74-feb2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629133018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133018, "uuid": "305b80c0-361e-41d9-b051-cbf8e6d566cd", "comment": "Malware payload (Gafgyt)", "value": "116f1e98bfee627df80d3df9b3dddc4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133018, "uuid": "f3edc87e-c86b-41a0-91bd-968b523be3e1", "comment": "Malware payload (Gafgyt)", "value": "aeb273216ac50c348ead557ce21d3afdc06f4b12c5f91eb2ea282ab81e8e0163", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133018, "uuid": "2a7ac298-ae9e-4b08-9e00-e52640cfd6a4", "comment": "Malware payload (Gafgyt)", "value": "090dcf9659f9fdc9055692ca165ae2e3c8d3d6d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133018, "uuid": "7796defc-f975-4296-ab7a-e36dffbbbd74", "comment": "Malware payload (Gafgyt)", "value": "3916ae29655988bcaf334319a94a7730920d345aa829140c720db0a7e8dcc65c4acb3796ab898f86faa9e480516684c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133018, "uuid": "30352768-9c9d-4877-8b7c-9c47d66a795f", "value": "T187F33905E6408767C1E3277AE6CF424D33339B94A3DB33059938ABF43BC2B995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133018, "uuid": "a172bcff-829b-4844-aa97-ac3da1307f35", "value": "3072:tp63mZTyWkCxUG0aSnlySvnqpeM/9LgmFwfBxKQodn:S3mZTBkCqG0aO7vnq4M/9LgmFwfBxxoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133018, "uuid": "e34e16ad-b1b5-405a-be30-f394cff745c5", "value": 160978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133018, "uuid": "ac072aed-9271-403c-872a-a9659cdcfbb2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133018, "uuid": "f13cf1a4-bdd5-4fde-a9d4-b57eded0473b", "value": "116f1e98bfee627df80d3df9b3dddc4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0c089c-fe52-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629091446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629091446, "uuid": "54990c10-7ce4-4953-859c-4771e522af55", "comment": "Malware payload (NanoCore)", "value": "9bdfa3add2456a5efccabdad1343fa70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629091446, "uuid": "ad677d1f-cdbf-468b-959d-317bb3d22632", "comment": "Malware payload (NanoCore)", "value": "afdcfeac16d321fef57c2aae9b001952544a53fc785ba78a6ad794a81bef0c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629091446, "uuid": "01755036-cb3e-4d59-8f93-2ef9059a26f2", "comment": "Malware payload (NanoCore)", "value": "02a34db66b361e9cb326f32d6e8f71f1cd284b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629091446, "uuid": "84b063b5-a434-4533-952b-c4249e9c27e6", "comment": "Malware payload (NanoCore)", "value": "4735accb0be8083e9d15eae2d191e0f5df5f4c4f8c3d17a113a4f456603f2696bbbf33c100b04a326ed93f3ad308e3f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629091446, "uuid": "ef94b296-cfa9-4929-a176-504360438e76", "value": "T1D05539343AEA9019F173EF795BE4B4A79A6FB3733B06541D10A1034A4B23A41DDD293E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629091446, "uuid": "b59e6d3c-ce16-45bc-b6f1-294a2c1f9567", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629091446, "uuid": "64f867e7-cbfd-466d-b2a6-08a97a426915", "value": "12288:AJY93uguqMv8VZ2TrUKAnbz7G1fh41p65MfYY3OZTmygvwXzDtTygmHN4SpdluFl:AI1HmejyMt1dudyJHFm53gFU3aOXAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629091446, "uuid": "8a71bfc0-640f-46c8-9649-94581c321411", "value": 1294336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629091446, "uuid": "fd74e46d-0a13-4adf-9b50-fbac767b00fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629091446, "uuid": "fc236b56-ca4d-470c-9311-4a4594d7320e", "value": "Remittance Form Payu.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428033ab-fedf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629152041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152041, "uuid": "958b2b80-b4e8-4e26-a92d-25aece887b23", "comment": "Malware payload (Dridex)", "value": "37fba5771c84c2beced539f09b305d56", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152041, "uuid": "fb139838-e406-453c-9052-02f14a9b6a8d", "comment": "Malware payload (Dridex)", "value": "b03764601661c3f119aa08a115442284c0f9d585478047e046b1aa027632ce4b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152041, "uuid": "339c057b-071b-4c29-a90c-bbe9d123a133", "comment": "Malware payload (Dridex)", "value": "9a86f63a66f939b3b6d9ebf0043ce9814d1f6684", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152041, "uuid": "8f274231-0058-4cbd-8ada-a992fae91f9e", "comment": "Malware payload (Dridex)", "value": "578fb8cad7c4e50d0703c198739bd1950156f722c1f3f6cd6ff5cdb5d873101acfc4d1995c08d30e404bf13ddeac3562", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629152041, "uuid": "4e211be0-c859-45a1-a117-81afa75b1c6c", "value": "T1BE44F1152543E92DFA4F7D3D8CEE20747F8ECDAE09002BAB21B1A61CDAE57CE4D29055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629152041, "uuid": "9e3d27c0-f3e6-4abc-a85a-792a48418df2", "value": "6144:SktZbAPPimNA/kjoitkxKLMfrLcxthJt1CA0AjdPi+OLK2v:ftZbAPDNAcM4Moxthjv08E+YKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629152041, "uuid": "77e2e324-3365-4052-b456-34ae209b900a", "value": 272099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629152041, "uuid": "9ef65ca5-a6c1-48e7-96dd-ac2d3568637b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629152041, "uuid": "99fd747c-4806-4fb7-a037-e859a95acec2", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_5737227.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8758641c-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629114360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114360, "uuid": "6e44bcd2-1ad7-4bd1-a1ff-a21889338268", "comment": "Malware payload (AZORult)", "value": "48892fccfe8ca57874d266e893e5fd9d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114360, "uuid": "3d2ce43c-498d-4742-b8b2-970f3b1df51f", "comment": "Malware payload (AZORult)", "value": "b084b982935494e958fcfe724111764f06e05f4f4023731fd83edf68c284074a", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114360, "uuid": "aa31b8f3-e680-4886-992e-3c8cc951c40b", "comment": "Malware payload (AZORult)", "value": "337a14604988ca381388aef5d7f78683f3e5e9c0", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114360, "uuid": "def7e90b-cf2c-4cbd-80a6-bc99eb7b775b", "comment": "Malware payload (AZORult)", "value": "f1f7a8d3766e7b8aec2c3647e2a4eb4035f3557953178934ba2414e6dec4702229f18542dae0176011d9c11fabd7729d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114360, "uuid": "c04c65d7-c60b-4000-839a-2d89a66bfb53", "value": "T19234DFE0E312A5D6C8BD9674C81A982E67F5A17ED6B0C3DE6FA747D0281A1432CF1DC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114360, "uuid": "727a3ecd-9740-41df-b536-cef046277392", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114360, "uuid": "8531dade-4966-4b2d-93d2-70b9a29b16eb", "value": "6144:5dVXtDWgsEyZRmBDhvISLgqPDeQo9OQ1qoYm:5dVXtDWg0mDgCit9/wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114360, "uuid": "76e2ca90-92d0-4d15-855e-9174e3eadd6f", "value": 245616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114360, "uuid": "a07e17e6-d3f8-4322-8174-8bb286d4109e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114360, "uuid": "ce8f7856-0ff1-4215-a766-a46db090f432", "value": "HalkbankEkstre1608219773667200308882717534.ex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4aacd5-fe5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629097244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097244, "uuid": "a2e8ddfa-3b6a-47cc-9f1c-39b91f212c45", "comment": "Malware payload (Loki)", "value": "b13213412b30d3f7afe7455d5a19cda8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097244, "uuid": "e3cff4dc-ae79-4d11-a98f-56b6b41ba7ed", "comment": "Malware payload (Loki)", "value": "b0ceb69b666e841d84421dac62ca763d5fcc4621511527a3bbf83a72fdf5520e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097244, "uuid": "605bac48-9fdf-4b3f-a685-971b72ec521b", "comment": "Malware payload (Loki)", "value": "2f54e5935860f27f5c2546076294a5011f187a8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097244, "uuid": "30194a38-7b9e-4a1d-aaba-e404d18ad785", "comment": "Malware payload (Loki)", "value": "7c497e0104925f83a8919c184d25f0d86853725e380091435128d72e981011b18b21601f881c425c063e098c22d5b6cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097244, "uuid": "1ad2fa34-abfc-4e1a-bf8a-4d80a92eae0e", "value": "T13AE4AF71709B8A96F11F4AB42578BD5403B231F3A9C6C9391B1A6146CFEDE983F4860F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097244, "uuid": "519fc0ac-e152-4d04-849b-0ddfeca0d836", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097244, "uuid": "6a6ca732-6f9a-4d14-a496-746a4fb3a982", "value": "12288:NqL5JOEP0dN7dB0NVSVuLUEBLGQcayzPDWY0KaysIBja:oNHPQ9dfYoayzP6YqBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629097244, "uuid": "8b2dd2e8-5e25-4b45-8a5d-4bb6d7d4e4c1", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629097244, "uuid": "eefcfb37-225f-4a93-b6e4-412545da2266", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097244, "uuid": "6b20d488-b2fb-4c09-b145-9194edfae4ad", "value": "RFQ REF AMOCT132020-B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf12ffcc-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629132520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132520, "uuid": "3199d398-a444-419a-831d-e6f075dda04d", "comment": "Malware payload", "value": "fb4920dc4cf94d6ae15ca6edd202f790", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132520, "uuid": "6516723e-27d3-4bce-8daf-4d7217d84314", "comment": "Malware payload", "value": "b21f8f25e274da771bdbe525c43aada072dea06b902e9b1080e6156006379f52", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132520, "uuid": "2b9cd12c-28ae-4cd4-b4dd-626f1fff3218", "comment": "Malware payload", "value": "41988b5fade9950bb630e5b082467b24cb944c1a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132520, "uuid": "4e0f4461-f686-4494-87f9-0990587f9103", "comment": "Malware payload", "value": "437b7adb3da0b352e7546f873a8459c633757c9030bdff834c56237f31d60572b36273e026458161fa2dd90b1f06a8d3", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132520, "uuid": "d37f98a3-7beb-4fa6-b9f9-c800ecd459ef", "value": "T1DB4512169898AFADE05A44345C6DD47073FC6C02B8BF96B91788BF8EB0B7E427152317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132520, "uuid": "9e224201-d6db-4520-a950-3c8025504a83", "value": "24576:TqPZ+WD1lvdXMptXwsxmxQzEBGH0ed+WrG3yrjJOdron9jXBFcfqgVITkyr:TqPMQVXESQ0GH0DMG3yr4ho9jXwfqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132520, "uuid": "c247ac87-5659-4c3e-ae21-289c01476e9e", "value": 1227288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132520, "uuid": "bf775e8f-83b3-4f3c-998e-27d40c2a5f81", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132520, "uuid": "87506701-139e-4331-a2ee-c3170312d289", "value": "PAYMENT CONFIRMATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9319dde8-fe56-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1629093335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629093335, "uuid": "d61df824-8d5a-45de-aec4-034584f415f5", "comment": "Malware payload (DiamondFox)", "value": "eb7233922891e1dad0434fbd52623647", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629093335, "uuid": "6547e437-2e0d-4e78-85de-7540f24f4bf0", "comment": "Malware payload (DiamondFox)", "value": "b39e29c24003441609c457a3455cae9d9fb6f4462f5e06d0c1d317d243711cb8", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629093335, "uuid": "2870a53f-8cc4-4747-9d76-e509456ec716", "comment": "Malware payload (DiamondFox)", "value": "331126b108532ab9a1e932141bff55a38656bce9", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629093335, "uuid": "94001bbf-f3f5-4998-98fb-8397ac1d1752", "comment": "Malware payload (DiamondFox)", "value": "bb0e069b058444b01d90be62b6fa5045e9cda4276894be472fdcc107756990b7a66617f8680c4c4bae7ebab2a58c0390", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629093335, "uuid": "48347679-602b-4fdd-8110-ad125d55a076", "value": "T1F186331125D64130E23606345BE8A2306BBCFCB19F684AAF97DD6C4D8E355F0BA7770A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629093335, "uuid": "6db9c3ea-b42f-40d1-8ff4-9463a3255f96", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629093335, "uuid": "a96f5907-9e30-4424-b854-d603d92e0600", "value": "196608:41kIY19mLlZ1AM8uizyFMoKoEHihPnjTr6aGEiINJGzXe:jilZ1v8w3jhdGEJG7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629093335, "uuid": "a2b699a6-63f4-40bf-8dfb-78c61148ea65", "value": 8240780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629093335, "uuid": "7688ef0c-2ef7-45e4-889d-e3da5b0720c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629093335, "uuid": "25676573-c4a8-4055-b1f6-21b7bf3b95c8", "value": "EB7233922891E1DAD0434FBD52623647.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6914ec90-fed7-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629148669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148669, "uuid": "cd32a069-dc13-4c15-9759-18d3342433e5", "comment": "Malware payload", "value": "974129324d94982067fcdfa802f2c906", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148669, "uuid": "29fc83fc-0d09-441d-94e0-4827a8c93d05", "comment": "Malware payload", "value": "b4d64792408b8cde1d71a4b607bcc1a93f37f21559c0cb672073e2031253d68b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148669, "uuid": "ce5a4c07-6700-44ab-bf5f-2d810ea53856", "comment": "Malware payload", "value": "032d618021f142af0758b5ffd7de96b28f759bf3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148669, "uuid": "2a126970-a50a-4543-abf1-d51d2c22ef9f", "comment": "Malware payload", "value": "e9c2755b7aae1a6b4f220e040df0dc147bc88ab2cfb63958a89a4f761204b048c983931022db0b4028243f774fc6adf6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148669, "uuid": "aa250647-9aa3-49a6-8929-968b9015cde8", "value": "T13B14D049D25B23BBF9130074A8E276398613F9994785DB93FA41C97BE9D0EC24738363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148669, "uuid": "c352536c-eaf8-46b3-a321-906f39ca0bb3", "value": "8fb9c33d660a73e17ccb39e76d1e6039", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148669, "uuid": "b9e453e1-289b-4a3a-a619-2ea1a47c53ee", "value": "3072:phYiCQXKgH7xFjsDlyk+AZ6cGdgwQDDu15/aE8tZgrkVCuLnT:j7xFGlyfAZ5DDuLydzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629148669, "uuid": "b71868af-aafb-428f-9a0d-77dfec046315", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629148669, "uuid": "997a34be-289c-440a-aefc-a656be51cbc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148669, "uuid": "89510ec8-73a4-4af1-844e-7d8e680af8c2", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7952ab24-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629125933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125933, "uuid": "2bc05735-c065-4fe4-ab92-5b5f03caab9f", "comment": "Malware payload (AgentTesla)", "value": "8f95445cbde089ce3c348c905deee2b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125933, "uuid": "27ef8501-7c16-4758-8a00-46cab9ede0c8", "comment": "Malware payload (AgentTesla)", "value": "b50461ce90cea121522ed19cfdf717c426f60c6d0968c846eb424af385c810e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125933, "uuid": "59f92343-6627-45b7-8634-6bd1483f8fe6", "comment": "Malware payload (AgentTesla)", "value": "6315243bf46c7b4bd7a8c952284f74e5d7276809", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125933, "uuid": "38be985d-bfc7-45ee-9dda-7123b75181d0", "comment": "Malware payload (AgentTesla)", "value": "bd4be770e4481f3803765f0e1d628a06a3c1672153c997de4f06faa9b559353864218735c4cc9d24b88995487eccdfd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125933, "uuid": "77368a7f-bd3d-4120-b44d-c4ab51b302fe", "value": "T1F9E4027226EC4783D6042B792092609303FFD2296781EB99BDD612F243BFB544B74E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125933, "uuid": "a6510090-546c-4b86-9c01-89ca35c05102", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125933, "uuid": "6c9a8959-02c8-466a-81aa-f32aea69c989", "value": "12288:FWxm/HK7zJCn0uWh1i+dXNbAoEvEl7cqyG8kQGaEqoNM90QZ55oAgiR/:ylCn0uWvzXNbveEhYOtazoq90Qz5o9iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125933, "uuid": "06f4ac14-fdab-4b07-a65d-230888247bd0", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125933, "uuid": "7b2b6931-f438-4f21-a0a9-184c44cee2a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125933, "uuid": "dd48fee6-0ce0-4471-a128-229b4046eed2", "value": "COMPROBA.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677236e9-feb3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629133205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133205, "uuid": "a5a03112-3ba3-4274-b7a9-ca894bb1581f", "comment": "Malware payload (Dridex)", "value": "584d824f52037d79678ecbbc1912378e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133205, "uuid": "8946471b-9666-4d31-8562-d2d735057cd0", "comment": "Malware payload (Dridex)", "value": "b54ee6efc0c87d4befd86a1ff8362f8790986497104beb18fd397583a8cd0bb1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133205, "uuid": "0f751292-66d0-4da7-933e-2ea6ca34cd22", "comment": "Malware payload (Dridex)", "value": "173916f572b7844ae12b4982143a1f3c2f32df9a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133205, "uuid": "647fa62a-7b1f-43c0-83ab-5a8bddb6977d", "comment": "Malware payload (Dridex)", "value": "cdab76f339016d39dbc78b13695f7715f38f5ea65c10b1a591b182730c23090db2c4d0892947d463b1732434fa2893d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133205, "uuid": "3d3f8738-a873-4530-b21b-bd465a99f52e", "value": "T1876401965957F48CFE5FAD7D5CAE21707F49CEAC16002A7F31E1E22CE6C02E66D18086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133205, "uuid": "e33ea852-8e2e-4567-af2b-bf6ce1879e24", "value": "6144:SxtZbAPPimNA/kjoitk7yNuR2UQSq/O0T5XndpPJricJrt:AtZbAPDNAcMryYR2pSr0T5Xd3nT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133205, "uuid": "efa70a05-81c5-4840-9737-45b35fe64d7c", "value": 319459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133205, "uuid": "fdfc9108-3c20-471c-a042-ad80ec307bf4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133205, "uuid": "ef4bc11e-5969-474e-b344-16d73407dcee", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_4_23286995.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad89a2a-fe83-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629112434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112434, "uuid": "4c21b517-d457-4ba3-8cea-e6c450344568", "comment": "Malware payload", "value": "37440402e2f3bed12f391338cbd4fc12", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112434, "uuid": "b1e5a4e8-3f01-4d2a-b1e1-da941ba76b66", "comment": "Malware payload", "value": "b5bcdc51fdaabc11a62e8401493b5fa24b6f4a350d597cc58a04cfc0dedefbfc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112434, "uuid": "8d3ff490-f9d4-4c29-acd2-dfccc1505bb7", "comment": "Malware payload", "value": "f28f9be236b1593f2f7da3ceb4b0478c96c7b0d0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112434, "uuid": "8f6521b1-8b28-46f8-9fcf-923f2d3d0db3", "comment": "Malware payload", "value": "df90dce9d124030696ca286316c58d6668d446468649e24ec9029302d5d36e1f7c72b50de17677339ab65f0e5c197891", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112434, "uuid": "f5f421fd-fe21-4503-b208-120166fcfc8b", "value": "T179227D3CC649A90AC226087DD02992FAF32C9427E343F86A610573CC4B617C387CA1BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112434, "uuid": "d6c93151-67ac-4153-9960-8ef62053a70f", "value": "192:ScIMmtPVG/bD1YafOOsgb5SEzBC4vNqW603ZR:SPX4D1YLOsKhlqar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629112434, "uuid": "83111a73-49ab-4212-befd-9255a7dac709", "value": 10326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629112434, "uuid": "246a017e-9a49-4f77-ab9a-5bbe42d9b7b1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112434, "uuid": "e672b66e-3a45-4f8e-b740-e971e2d2c180", "value": "b5bcdc51fdaabc11a62e8401493b5fa24b6f4a350d597cc58a04cfc0dedefbfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b369291-fe3b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1629081645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629081645, "uuid": "b278fab9-bf34-417e-9cce-4da11bf8566f", "comment": "Malware payload (DiamondFox)", "value": "3aa3919af2e858ed404c963bb19ed248", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629081645, "uuid": "df2c5ea9-8444-47a2-b371-af8644923940", "comment": "Malware payload (DiamondFox)", "value": "b5f88e34db4bb65da8c21982590b67922fe32e62e7cfaae9fbe417a4262aa143", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629081645, "uuid": "21ddf729-8f85-4e62-84a3-a777dc32bacd", "comment": "Malware payload (DiamondFox)", "value": "f7751ed5bbbbf0805cb97f1b0f8736d531741ad9", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629081645, "uuid": "d6dc2d1b-dc08-4fc5-bd10-bf9fc43ebab2", "comment": "Malware payload (DiamondFox)", "value": "1ffdc01d7eadda14203220f0fc790333a7188d83ed3b6dc8d514bad236fd8d34a46dac612355cb960fd3dd880aa3db9f", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629081645, "uuid": "4466bf5a-ecde-4023-92f3-1370bdcb91f3", "value": "T1F39633113F9098F2E2F16D3607336F10493CBE246E264D6FA7645ADEC579082AF31B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629081645, "uuid": "648a3ec1-4fc8-460a-8e93-b431a6c1ff1e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629081645, "uuid": "c25dc09b-09be-40bd-b85b-9b5206414866", "value": "196608:UdE5aRW4cuxHd/Q51nOAlfkvXhseFMYUOx4ELSLe:aE5anz/QuAlq6DVM8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629081645, "uuid": "eda96448-00e2-4a4d-ac6c-4e53cf1af355", "value": 8984676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629081645, "uuid": "03679086-23f9-48fa-ad78-6f4e9ee1f315", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629081645, "uuid": "5c7829c9-2b73-42f2-9292-85c7e4f9061c", "value": "3AA3919AF2E858ED404C963BB19ED248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4acbffa-fe74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629106276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629106276, "uuid": "deaaef1f-9297-4507-beec-fd6567f4a436", "comment": "Malware payload (SnakeKeylogger)", "value": "85ec8c55fb054ccfd577e19e5c51ac24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629106276, "uuid": "83a295ce-1c0c-479e-ad6b-25c5e8f1548a", "comment": "Malware payload (SnakeKeylogger)", "value": "b63936bdf1e15df57a5086b9de890e35d5e6a118c7680fd1fd2227a56b57365d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629106276, "uuid": "f878f9a6-39c0-4296-a16f-4f539fc6c0c1", "comment": "Malware payload (SnakeKeylogger)", "value": "445d6096cda86e2c0e8adef881aeca15414224e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629106276, "uuid": "6b144b85-c70e-4ab1-85e9-28b0be7315a4", "comment": "Malware payload (SnakeKeylogger)", "value": "d99b5148b2e2c27f42d1fafdd7fd0f154a3f83575e3e22f7372756863c48136bcd2fe17c2d6bccaf8943e2efd945bbf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629106276, "uuid": "34ab0d9d-c96b-4fc3-bbd3-04f3b7447ee7", "value": "T1EDF4077B3110E56FC027C939B4580E94A6FC5CB2B2CEC657B4C33568993DB579A022BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629106276, "uuid": "72474ce0-eda9-4f64-b6f9-d1d89a4a4145", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629106276, "uuid": "cd3bf3cc-f18e-44de-a066-adef8fe78524", "value": "12288:HI04AEzi1D00FGA77PyRM9GM1mnYVlr52jG6YtnnxUMBmfbJPN4lxoOksuV:FTvF/FGA77fAMcnDS4Aks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629106276, "uuid": "f6683668-970f-4209-8b61-21b9073c64d6", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629106276, "uuid": "0f958e48-3ee1-4514-afa4-7d52b20dcf09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629106276, "uuid": "0b7591f0-2c96-4d1f-b10f-4ad2d4a11eed", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b0eb02-fe36-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629079412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629079412, "uuid": "3332a2de-f7bf-4995-a36d-c4d399208b0b", "comment": "Malware payload", "value": "ef9db1eace0764afa86e018e7891e9e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629079412, "uuid": "bb4f3125-fb23-48d6-beaf-b6369e1a272f", "comment": "Malware payload", "value": "b7e83ed67328384c54066b0d41926b0828b31d8f56c3a6d36d3ca7bc543f6e6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629079412, "uuid": "5be2983d-f554-4287-8797-84e611955cf8", "comment": "Malware payload", "value": "80d83b0a9e51f9a79485fa69ec40b516f4d37153", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629079412, "uuid": "443006e6-b437-43aa-82ba-41a6df2bd804", "comment": "Malware payload", "value": "f3b74b889595deec205889582b412979140b13fdb86b2b7499d3a62f6a50f10682488fdeb2aea7017b06bbdaeecd64c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629079412, "uuid": "55ff19b7-ff02-4cc8-bad3-93908e98da8e", "value": "T19E54E10DA94FC432C787353094738B6C5A79AF10EA5701BF27581AAE6F30FF16A29355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629079412, "uuid": "6c8e1493-c62d-4877-a013-e4fbd3530521", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629079412, "uuid": "4bfda7b4-e7a6-47b9-b6d9-2ed522a10273", "value": "6144:rSLNgQ8LkcDCbg3EMmu5LWsgVECMMO4c/mC:rSBb8LhCbg3EkW/VEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629079412, "uuid": "148b68f8-9e78-4c0c-819b-9515a2dca959", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629079412, "uuid": "cf2360ce-8cd3-4724-b71d-dca5c953909d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629079412, "uuid": "fa1a9b5b-8dd8-42d6-b3b6-7eae566842cb", "value": "ef9db1eace0764afa86e018e7891e9e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120b1c96-fe83-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629112446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112446, "uuid": "249efb83-ce89-4198-a454-41d7c1ab5bde", "comment": "Malware payload (SnakeKeylogger)", "value": "b927b94318758a41ef6bb68638ba104f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112446, "uuid": "0a59d7c4-6df5-420f-8f3a-29708779f1bd", "comment": "Malware payload (SnakeKeylogger)", "value": "b81f81d1277c58dee65b780964423365db4650fd2fd63dbd82d2df52e66a9d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112446, "uuid": "c04b47bd-7fab-4b56-9e8e-62ae376c32f6", "comment": "Malware payload (SnakeKeylogger)", "value": "6af632a47bd7ca3e046ed5c8c92a7786ba3085c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112446, "uuid": "71874d5a-a16b-4ff2-b44f-7c595eaacb23", "comment": "Malware payload (SnakeKeylogger)", "value": "7f339547c1b83a2a63c6fb7e704b6f395fb6aea9aa575a71974ac88ec4e817617cb64e2dc821923557b5afca4cc6be58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112446, "uuid": "3f96338b-573b-4009-bd72-14c53620a144", "value": "T12405AC2900684B67D63A97B7C165A350FFF15DA27240ED1A4ED3F8C32E127432A9ED1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112446, "uuid": "10fa631a-b9ff-46dc-85fd-f1edef614e5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112446, "uuid": "b826d1e7-1d72-440c-b0d4-00d81e30bbde", "value": "24576:KJWb2DrO4+yZUmj9WUQHM8JrI3MtiozijaVoZ:oWb2AyqccM863Mpux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629112446, "uuid": "ce91cbbb-cf34-46cf-a677-7e92ec29085b", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629112446, "uuid": "1799678e-e13c-4ce5-a81d-8df4657c4995", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112446, "uuid": "6d10c8da-0212-4944-a762-8918fc07ebb4", "value": "b81f81d1277c58dee65b780964423365db4650fd2fd63dbd82d2df52e66a9d8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e30f5a2-fe77-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629107446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107446, "uuid": "9aafb946-a431-4375-864b-8ac8965aff53", "comment": "Malware payload (AgentTesla)", "value": "bddd312aa24da8bf54b1c464f4d924c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107446, "uuid": "95a17729-8f6b-48d2-930b-7c6d085a0700", "comment": "Malware payload (AgentTesla)", "value": "b87496adef518762cc306678879a6388e4dd08a86f1c7c55ac3ddedd65e19267", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107446, "uuid": "11c817b5-9eb2-41f9-9c2e-428b7d56a024", "comment": "Malware payload (AgentTesla)", "value": "672cdf073db5aa637572848bb2f6fd9a0a8c8ebc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107446, "uuid": "a73d03e6-8e0b-474d-bb4b-d83bf1d8861d", "comment": "Malware payload (AgentTesla)", "value": "232833621dc34ab270d05286382ff9196b551c776795ab5318f87843017e987e0a2a4dab0895cf3899279af46a8b23fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107446, "uuid": "39b1663f-8efa-4c49-8a1d-4b473e2ee5c9", "value": "T117F4B07071E78A96F51F4A742578BD5403B231F3A9C699391B1A214ACFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107446, "uuid": "c8148682-dbb9-4385-952e-3ec6cae87592", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107446, "uuid": "f62b3ed4-e0af-4b87-82c1-07ba0ba740c6", "value": "12288:M7YZ0Mh9H2OI2Y+YdlpZiV+dlZHVh3bU4wb1c62y5JOEPpBja:WG069WOoFlTJTxnLU4wbJHPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629107446, "uuid": "fce437a1-728d-41cb-b004-168a9059f74a", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629107446, "uuid": "8be0f406-70f5-4641-b051-9610e81f1153", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107446, "uuid": "32cbe67f-ed97-4b48-84e8-a9fe46c1f263", "value": "wOJ9BroUUOSJerB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca530241-feec-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629157852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157852, "uuid": "20f47537-8dd4-4c82-9906-0bbed13eadcb", "comment": "Malware payload (RedLineStealer)", "value": "375c1ffe19f2fba6ff5f32b4000cdea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157852, "uuid": "781ae330-1bdb-424b-9a5c-46c8d7795e38", "comment": "Malware payload (RedLineStealer)", "value": "b9f79bcb4c0ea9e939b35813e807fda308b7038f1dea613e7d8bbd7fe127ac84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157852, "uuid": "f0ab492b-ef21-4b1c-8f96-8f8060b82ede", "comment": "Malware payload (RedLineStealer)", "value": "2557bf9d890e4e0832fb03474657dae9c0037db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157852, "uuid": "3eb5993f-fa03-4040-a7fc-d2b808f985d4", "comment": "Malware payload (RedLineStealer)", "value": "ad474a54ed437be122fd6e8800764bb819e00dde184c4e55812202f30d6daeae88b7350f9b1246fcabb1b3c5a45ba8bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157852, "uuid": "acd34534-5034-4218-b16a-2109776a02f3", "value": "T19DD45A3155A4F8A6F4A50CB8A1A6E3B698386F758AD78053F2B0773F86323C17C64537", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157852, "uuid": "507c0be4-184a-4035-976d-62aae437efce", "value": "d0f5faff0d9a42cffdcdc1bfda477ddc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157852, "uuid": "4861b327-22bc-4fe2-be1a-f8c3672e7719", "value": "12288:s36SNp0mWujfyGGNcR6+mgGak6H3lP3XJik0YhBhrfz0:s3m7r+876j0KDrr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629157852, "uuid": "9c3e0d91-4b61-4979-8427-20d676908a15", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629157852, "uuid": "b492b74e-6aab-4872-8d21-ae8bfc091b80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157852, "uuid": "089aa573-4943-4592-a1fe-1e182b33fdc3", "value": "375C1FFE19F2FBA6FF5F32B4000CDEA4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41641701-feb7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629134859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134859, "uuid": "976472d1-53f6-4b8a-a21b-04d75daa1084", "comment": "Malware payload (Formbook)", "value": "0dbdba6f102e5d4b18518e7cbf4a2e38", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134859, "uuid": "a88fabc4-1f8c-46b8-be5e-e336867bd4e9", "comment": "Malware payload (Formbook)", "value": "ba852a2b1acc3b7c2bb98e6acbe41948de4e8046bbf6c3a874d7462f23d19f1e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134859, "uuid": "6e52770b-4d46-4189-987b-b7652ac1bc84", "comment": "Malware payload (Formbook)", "value": "42239bf215805016ac0e02f049f6012718fee8d7", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134859, "uuid": "f5dd0a10-e7f7-415a-9a1c-ee3ef3af4048", "comment": "Malware payload (Formbook)", "value": "eb07c4e2800aa7a8185255c94171d1fffa55b312ae55d7d5c1b7d6206ff2d0fba468b1629f8c7be09273a86e39e0bf02", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134859, "uuid": "d4860194-2bc6-4467-89ad-e49a9e359b6a", "value": "T1D5C4AE11B1809031C7E134748FA1C6B66778AE3C172644A7A7F4AD7B7EFD2D36630A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134859, "uuid": "32db285b-2cb5-4420-9bb3-27902be57db5", "value": "53c59b75f4f7c3e4cf3b5a4fc5238353", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134859, "uuid": "d609b005-49a3-4775-b39b-02fb611e6f14", "value": "12288:zmiA96DUD62JYNUm7SeVgK4POrF86GUbcSdFlpsc:zhXDU3JYWygK4POrdDFdpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134859, "uuid": "393df01b-9863-48b9-a50b-c6312fe4d9b4", "value": 589684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134859, "uuid": "73ec38f9-d0fb-4ca4-8db4-8c062af94de7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134859, "uuid": "5c6ab334-abfe-4dd9-a149-12cb4c46218a", "value": "DHL Shipment doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3196faba-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629133973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133973, "uuid": "4f02d739-3bc0-4932-a06c-cb41f4ecee7e", "comment": "Malware payload (NanoCore)", "value": "5987fdb834a1806ba867d6f823ac12cf", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133973, "uuid": "376c1b5b-9ec0-4875-9e19-38af19c273ef", "comment": "Malware payload (NanoCore)", "value": "baccae266c8f6949ef7959d266763ec5e61c6a13a748ddedf77acae4f4174b31", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133973, "uuid": "2175d975-2187-4334-bee3-4768f306c626", "comment": "Malware payload (NanoCore)", "value": "0cb1ffe7ac9b25a606fdce8a5f4521913f577c11", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133973, "uuid": "de1115d3-0dcc-4cf1-8a90-1584ac5e24ff", "comment": "Malware payload (NanoCore)", "value": "f757941e379f17943c1a09c13fe3e7c0a54e02e64f30b60c73e645a79ab9ecbf300dbbeeb1946b5b0339bee564cecddd", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133973, "uuid": "89de25db-fb4f-4c50-829b-241285ce396d", "value": "T122317E0470331993EA06D42231A731DDBD312748AABB8B71145EEA42AA409BF5C5CAB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133973, "uuid": "8a3315ca-8a46-464d-a726-27a1bdbdeb1a", "value": "24:rEEPdqnWahNjJPpUI0I2rWGItUIZOIIIPITI3uFIJwIEIfILdgcjacdgcquU2b7v:3+Tx2Ahn1wE+FIzhg3Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133973, "uuid": "4e01fac7-af7a-4a00-bccb-3cd872d3b3f7", "value": 1600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133973, "uuid": "27919893-c971-4b98-8b87-3505c36e2ee9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133973, "uuid": "bc025ceb-6890-424f-9dfc-5c93029deb22", "value": "Y03140-Payment-Inv0ice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4d647e-fe84-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629112891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112891, "uuid": "085ebfd1-c6e1-467f-b8f9-6ff37dafaf54", "comment": "Malware payload", "value": "89a3e275d4eb674adf4253f59260ed41", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112891, "uuid": "f6fac687-83fe-4bfb-9373-6cc0e76eb64f", "comment": "Malware payload", "value": "bb8128f88f70bb24439f2f668edb339d88a4905d2559b9e98e22da0bd5a1625d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112891, "uuid": "14e50813-8663-44ec-8ec4-84a8146c6471", "comment": "Malware payload", "value": "2152098a1098641500631164632ce0174fa03408", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112891, "uuid": "d114e7a1-4fb5-4a8b-a8bf-11222d473b06", "comment": "Malware payload", "value": "8b6b0ce6168af8aadc5797c4458a4c0483a3e70f3e7853d7f3b50f196e8ba304faa1ee66a57e6c03fe2381435d6d11e5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112891, "uuid": "41a31438-bbfa-4cd5-9e22-e92a20cc29aa", "value": "T11B628D7BCD82BD38D30186B5A94607E0F64D528AC304F84A3026B6998B406975EDF9DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112891, "uuid": "4852b2f7-b21d-4888-a2ca-5b9ac213a76a", "value": "384:TDCXYyrmpLNbH4J570xG67aUfvotlp7I6:TtyaB5H2UnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629112891, "uuid": "60146840-bc12-46f9-bc10-23c9220df756", "value": 14665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629112891, "uuid": "d6559d44-efc5-4fcd-b0c3-7f78c58e8d17", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112891, "uuid": "f5ce57d4-1443-45e1-a8b9-e55ab3fa27ca", "value": "Bank.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f795cce-fecc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629144036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144036, "uuid": "b066596f-b7b5-4cb6-a09c-7a2755414643", "comment": "Malware payload (Dridex)", "value": "b022cc37ef4539a49d65dde9dec5c67a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144036, "uuid": "e1b84bdd-7055-45b4-8c18-04d8c1af1205", "comment": "Malware payload (Dridex)", "value": "bd1e2680fd4e09beddf15f4f0918e2a9473962331f1a87e8dd8afec64cebc1da", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144036, "uuid": "2e00993d-86f6-4143-b4ca-d0f5d3e0c7e8", "comment": "Malware payload (Dridex)", "value": "3d01c44e63ed8485f30ce500c28d635dbbf819a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144036, "uuid": "6f817145-7083-41ab-b7aa-66bff172411f", "comment": "Malware payload (Dridex)", "value": "d556034244946d44c1b9e7ecf3a7da4474a202308369fd401310b027c40c174a64867499d11acbb01fb5de9f6d98e0ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144036, "uuid": "1d05036a-c297-43b7-ad12-4bd171a5dfa3", "value": "T1E34401549953E81CFE4F3D3D8CEE14706F9DCCAE21106A6F32E4E11CEAD02922C79896", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144036, "uuid": "61eba666-4a60-46f7-9d1e-63e8f9702c94", "value": "6144:S9tZbAPPimNA/kjoitkJfXhblTq8mr0ENe6:YtZbAPDNAcMhFpUNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629144036, "uuid": "11a989f8-da35-4f8c-8df7-74c06f4b7216", "value": 253784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629144036, "uuid": "334e7ca0-159a-498a-85e4-8ef7c92958c6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144036, "uuid": "1f8e50ba-0773-42d8-b22d-b9ba61d1523c", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_4_1548303.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35baa7db-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629125820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125820, "uuid": "3c22c40e-51b9-42bc-9875-ff62088bdd98", "comment": "Malware payload (AgentTesla)", "value": "686c55c79258cb4c099ce9ff24fcfbd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125820, "uuid": "f2f9d552-849a-44c2-a9a7-2ccc067c88f8", "comment": "Malware payload (AgentTesla)", "value": "bd1f84b7b9f29e131be37bf878fc9b3e1590e29ab2fe3d417e16b5e5e3ba38b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125820, "uuid": "b0a720ec-8698-46a9-96a8-3dfababd003a", "comment": "Malware payload (AgentTesla)", "value": "dcce06a035297487ad8f98eee9fe74367972c0cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125820, "uuid": "e6953597-bcd5-4557-8b1f-634cdf69fa2b", "comment": "Malware payload (AgentTesla)", "value": "2b452b1d5a80d0b84064df683af003cb53e36becc1df24116cd4f576fa80acb222c3b6e095a85c3de9f12654d6b68803", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125820, "uuid": "5b166512-f4d2-4edf-9ded-48d933a5b4e9", "value": "T17844BF91AB0B0897D67C523AE255A53FB2E0CAB5C219C8CB7B5203C6F58E5552EF93C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125820, "uuid": "d55a71bf-d672-4b5c-943f-16c81a7f18e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125820, "uuid": "6609c70b-f1da-4d0e-8de2-799318f744cd", "value": "6144:rVw27Mw+/0uXSWfB0gs85Mqf7gqpUg5sPaYFb:rG8RyB5MQl5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125820, "uuid": "fc9e1a60-29a9-4141-a8bd-7f57bc3e70b4", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125820, "uuid": "417af221-1af5-4f8d-b405-32a6f19ddeb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125820, "uuid": "a038e6ea-1c4b-4681-951d-83ff73c6c07a", "value": "PO_BANGLA TRAC LTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbf656a-fe36-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629079720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629079720, "uuid": "a1f803a9-e92a-485e-830d-949662cad2c9", "comment": "Malware payload (RedLineStealer)", "value": "ed55b31cd1e8ce41e33d6fc8bd4540b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629079720, "uuid": "9018c46d-2880-451a-a745-9e08241bd3ce", "comment": "Malware payload (RedLineStealer)", "value": "befa68725fca25ee31ae8e52d2dd67ae3eb3a4073c46bbd260f4f8601050648f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629079720, "uuid": "7e27f32e-c26e-4461-aabd-371fef3561de", "comment": "Malware payload (RedLineStealer)", "value": "bd784d83e7fdceb83cb68f3cc3e6273a2cd676a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629079720, "uuid": "cc03735d-8fb4-4411-b0fb-66d9fe31a314", "comment": "Malware payload (RedLineStealer)", "value": "47c0fbb21b086da6f0f952b1989594d463854d3a27f2047b0d8a9ca7669ea4dde5196b82ae599e4ddb3c5df8473174b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629079720, "uuid": "6b6c6854-2285-4204-920c-d33b23afe252", "value": "T1F654E01D749FCBF2C3C5357064738B9C563AAF09D697047B27181B6E6E78EB0522A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629079720, "uuid": "da55867e-f071-402e-a1b3-a4ac15f19eb0", "value": "b6eb307a53194f1a2629d22afffc5564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629079720, "uuid": "936dc766-28b7-420f-90d7-36126bb03ac1", "value": "6144:MoLCZ70tVt7xBd2NCEh5hkMxRvwec/mn:MoWZ70V08G5ym1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629079720, "uuid": "bc1a827b-5aae-4db8-aa06-b1fad148e925", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629079720, "uuid": "cfb7308d-e29b-4e45-9ffc-43a274efaab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629079720, "uuid": "023f7671-a9d5-4456-95ac-914a49c7da91", "value": "ed55b31cd1e8ce41e33d6fc8bd4540b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7a5865-fec8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629142337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142337, "uuid": "9107d9c1-49ed-44fb-8799-0ffc06f6b60d", "comment": "Malware payload (Dridex)", "value": "b40d48738327522cc83e7f75381f73e5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142337, "uuid": "2be67758-da6b-44fc-8d86-de95b49f4f5c", "comment": "Malware payload (Dridex)", "value": "bf304c534a5f19a125487f4864bb17ff0c00d2f09e3620c1ab18e637a5ad04cc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142337, "uuid": "13cf93b7-58d1-4546-8f54-edf91169ba41", "comment": "Malware payload (Dridex)", "value": "c9f746b460f554d5f5e4ad61aeae268ea94b66fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142337, "uuid": "05c18278-10d1-45bc-a064-9948115b56cd", "comment": "Malware payload (Dridex)", "value": "e15c26eab8922bca695bd8211e4d1ca4bbcbde27b89c4e42c13fb28fb02e1633e1e69c91bddbdaccd31b7b76be88fc9f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142337, "uuid": "1cdb955e-e2e1-4e89-9dd7-7af29d607186", "value": "T1846412198473F090EDABA5386CDB0F9A2BF14F7F11916E09E2D1D60FE944EE351A214E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142337, "uuid": "baf09c7d-de4c-4740-9a15-03bfa52fd7a0", "value": "6144:S8NSLcq+YXEsRp9uvB17fruVRDNsie5rVELDvc8DbEKUacRB:JPYXEsRWr7KVRDmVExP+acRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629142337, "uuid": "7ff9da9e-e274-42fd-a7df-b621422878c3", "value": 314206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629142337, "uuid": "6ad91acd-a676-419d-a97a-ac0f4d0cb2bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142337, "uuid": "dcac5ad9-ea23-4c08-b7bf-d1b337b483cd", "value": "taxve_22053268_20210816_262983828_81811312.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fab762f-feb7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629134883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134883, "uuid": "35a2a927-fe1f-454d-b2c6-339b93b86cba", "comment": "Malware payload (AgentTesla)", "value": "b0757c86218ccd08dbcea4bf6b83b881", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134883, "uuid": "ac375429-8b4a-4389-af5d-86ca720c3aeb", "comment": "Malware payload (AgentTesla)", "value": "bf5844394d220549700daec7ead99e1ab5c67225c7e1f42d012858ae3167d99a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134883, "uuid": "027b8c41-e087-4bfc-a3e4-f0a30e6b39d9", "comment": "Malware payload (AgentTesla)", "value": "098f3a9c83d0e82eb4fbd9becab326b73ab86589", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134883, "uuid": "c827dc58-8ced-4177-baaf-07ac67f1ddea", "comment": "Malware payload (AgentTesla)", "value": "fc88dd3a74d5b1b1dc71b04a6d5e1adbc1499d3b25800c101276a801a3e6915143d1377d5b013a7ffff6553c11bad1e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134883, "uuid": "537e0b58-e875-4a8e-a821-8aa1bf827adb", "value": "T18D45C53915B82B27E079E329E6F44417B3E0985FB225ED59BCDA07A70206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134883, "uuid": "31995408-45c9-4bc2-98c0-9a6f99bde85b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134883, "uuid": "aa3c5e81-b19f-4a87-a30b-d24afaade755", "value": "24576:w9lTeKPbRFYrblhBarRzVjI8UVMK+gp5/SA1md:KEuyX1arzIHaK/5Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134883, "uuid": "b9bdee83-2536-4f98-ab91-f8f52ff81971", "value": 1221632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134883, "uuid": "2c318c78-f1bf-405f-a759-b554e92fc5b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134883, "uuid": "551afa38-33b0-445f-a800-65ae5cc03e33", "value": "HLXS20210816.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447b707c-feb9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629135723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135723, "uuid": "16f0409d-9c38-40c8-93ba-3b8cb3c91ed6", "comment": "Malware payload (Dridex)", "value": "5e9bd704a17284168c27181b31b97f2d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135723, "uuid": "d81991a1-e97b-455c-af8f-69b583ef365a", "comment": "Malware payload (Dridex)", "value": "bf89b96cc97781b9d929c7ee16ddfd1cc12a004394eb9b14daa9df974803a2a3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135723, "uuid": "fabb8802-ac4e-4fac-809a-a7e8311fda14", "comment": "Malware payload (Dridex)", "value": "b0e19d6c6b4e0647c6c4275748c4f9fa8cf7aef1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135723, "uuid": "38e2f9ad-c7cc-4391-a0e8-8ed44b37e863", "comment": "Malware payload (Dridex)", "value": "afa2bc93edf4e8eeb59012fe283dd60e42511e9282149cc9de4dfd6a56f61bdfcf69df8d233a58b3e4bfdb4af5bacc56", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135723, "uuid": "fa94d5a5-f73e-44a3-ba1b-410cd7dbe702", "value": "T1B7241227EF5CDE13C01ED3B7BE591EB107C34602A7067898A8A3BFA92E5457143FA149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135723, "uuid": "08c73782-1ed2-482f-997b-e92de3224796", "value": "6144:JogkLjLhVX1HRBKN2wZd8pe2ltOalEGXCDBkYxW9R:2DLZVX1xB6r2zzKG02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629135723, "uuid": "3e41f4e3-1051-401a-a171-80925067e632", "value": 230247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629135723, "uuid": "567cf847-dd8d-4a1e-bae5-36950d09add8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135723, "uuid": "d034afc9-d70f-4000-9300-4eb960be977c", "value": "_ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.2941805.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dae202-feb4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629133627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133627, "uuid": "d0b7addf-b621-4307-b8f5-7fc5904883de", "comment": "Malware payload (Dridex)", "value": "8f64cf4979db7e080e42843f125954a3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133627, "uuid": "6fa993a1-fe66-4618-8b94-6c35b98183f2", "comment": "Malware payload (Dridex)", "value": "c058c53a2d6d9b6aa1a22721198c0c828bb3d3de1a96b2ea52f9d197f9b70cf1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133627, "uuid": "f00e39ba-47ae-4e3d-9f71-26e90125c033", "comment": "Malware payload (Dridex)", "value": "77de683785cd1179409ce42f3293685273e9ca3e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133627, "uuid": "cd4cd03e-4a3f-4788-a612-e80dd8cae40a", "comment": "Malware payload (Dridex)", "value": "c331973a3de35e4481e812ec98d12dc0c90f18e097139544ececdcbea4b33941bff8be1f92070eaa5e4c56826cb64387", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133627, "uuid": "dd2d1dd2-863a-401d-8550-96e3bf9414f0", "value": "T13E6402513CA3E59CFE8E6C7E9CAE21747F89CEAF01006D6F12A0E16CE7D22C55C59486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133627, "uuid": "c93e53df-5dc6-43fd-b37b-693b3a6aeac6", "value": "6144:SotZbAPPimNA/kjoitkkjPfz0fstQpX6/qhkcSLHtRxsphV:ttZbAPDNAcMUoeQV6/C+Hbxs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133627, "uuid": "b1a23e54-e944-4160-bade-0ed4cc4821b0", "value": 333392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133627, "uuid": "ea083365-11f5-4398-baac-f34c3475a612", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133627, "uuid": "5110fe82-e519-4d33-a852-8ab43b357f43", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_8_9350616.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eaae164-fe5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629095260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095260, "uuid": "a7db8c22-c343-40ee-9809-16bd2d1c0b3f", "comment": "Malware payload", "value": "2cabd312ceecf306fb34337b1cec6b60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095260, "uuid": "a8f3d0aa-addc-42ea-861e-72d2512ba11e", "comment": "Malware payload", "value": "c075f5ed220d8525319769df7c13636da0b1811cb0497af91ea53b2473711bd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095260, "uuid": "ead8806c-9ce2-4e61-9b5a-763906452983", "comment": "Malware payload", "value": "651fcedd94b87db0d563feb34f5c45441bf58b19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095260, "uuid": "a454d04c-07a1-45f3-a144-6458a712fa71", "comment": "Malware payload", "value": "af738bf185b8f150b7dd227bd0e37d5825cdcc2a48d0f60e6027c8322e3c23c6b09e2492cdd9298e5bb5d4bc5f2bc467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095260, "uuid": "bf51be04-da3f-40ad-abbd-4685c09c4b8e", "value": "T14A545A243AFA5019F173EFB58BE474E6DA6FB6733B07A45E1090034A4B23A41DDC253A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095260, "uuid": "8b229861-c184-48c7-a619-528076a05121", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095260, "uuid": "81123ba7-cc38-489a-9941-a7e76f5fc4ca", "value": "6144:RJR/V8Jj0klDyNSj4mr8KZyvsanCdU9IbQXFWNIDScwzih:RJZV8Jj0klDyEjpr86yvsYC+GkXFWYwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095260, "uuid": "e654b21f-cbac-43bc-ace0-ec0803424720", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095260, "uuid": "dfea0887-e9ed-4c0f-96a6-53991c763450", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095260, "uuid": "e0d8860f-8b50-47b0-819b-3d2827141115", "value": "Swift Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308bf180-feb6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629134401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134401, "uuid": "8438b146-4731-4f71-8e01-613c6d88da17", "comment": "Malware payload (Dridex)", "value": "be7b5590ad4199e9a3bae6cac2475bdd", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134401, "uuid": "2f7a63db-65f8-44d7-9f08-ac2d66b6fbf9", "comment": "Malware payload (Dridex)", "value": "c11023a4b7d65c8b2ce84fc2156b818c12256943bfab2d16ff74c377c6fbd754", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134401, "uuid": "5d1da168-eea4-489a-b085-56938f4f0a49", "comment": "Malware payload (Dridex)", "value": "562024274c950b39da33826cf015d7e372d0f3e2", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134401, "uuid": "45cf59b1-073d-450f-8fb2-48c3f6b31bcc", "comment": "Malware payload (Dridex)", "value": "69891f3ed84d79b780994e6400eb6b545ad5e707848ef969a724a342f04ef9e994302a7d410d09e00d8a3c917021bd96", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134401, "uuid": "ff7cee2e-6763-42ec-ba25-f5b6accb8526", "value": "T1EB14D049D25B23BBF9120074A8E276398613FD994785DB93FA41C97BE9D0EC24738363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134401, "uuid": "897a4729-06f4-4d70-90c8-968b166dce29", "value": "8fb9c33d660a73e17ccb39e76d1e6039", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134401, "uuid": "50df3d03-039b-4abc-a2be-569b03ea4315", "value": "3072:ChYiCQXKgH7xFjsDlyk+AZ6cGdgwQDDu15/aE8tqgrkVCuLnT:k7xFGlyfAZ5DDuLyozT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134401, "uuid": "789a8963-f58a-4d90-b7c9-49fc68039a30", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134401, "uuid": "56fc498f-07cc-4e0e-bfa1-7cb2f4ed5f5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134401, "uuid": "6c04f001-06f9-4fce-bf91-cf20cb152c56", "value": "dI002Nt3U7U5Fm.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb09cc5-fee6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629155202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155202, "uuid": "25c25ecd-d685-4dc3-ab91-be11c9a2c9c8", "comment": "Malware payload (Dridex)", "value": "90f9986b219bcd08b55cc909a10697a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155202, "uuid": "e2bffc17-11b9-4523-96ab-07775990591d", "comment": "Malware payload (Dridex)", "value": "c170b070cc70ccb4879a9b7915f990275a8befad2a01a2fa94cb582d51c25105", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155202, "uuid": "c874c235-a244-405b-a66a-dd693351e48c", "comment": "Malware payload (Dridex)", "value": "95eefe41fd92c4aa08b6a77f29e23bc52537b0c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155202, "uuid": "b77fd2f8-fa78-49a4-b1de-26b450caf171", "comment": "Malware payload (Dridex)", "value": "7741570b462cc5077b8a72719b577c63cfe57b54cee95d45c0dea8932aea6d68084dec3bdb2a2f7bddda9be362cbd99c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629155202, "uuid": "bd4ee7a0-c46f-473a-aed3-c55b94c2bd5d", "value": "T11A64120B91B2F054E69B90B95C492FE52BE04EAF31903B46F1D5B42FEE09EF295501CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629155202, "uuid": "3970f346-72c8-410c-9216-52b05d49e3da", "value": "6144:SgNSLcq+YXEsHrzUOaQugNTiNRwWFQXJuuMlzKfGiUPqIW:RPYXEsHfUaNTiNRpukuCgLUCIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629155202, "uuid": "d80bdf39-9337-4b85-8ed3-7e9f4cee55cb", "value": 312120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629155202, "uuid": "47a949ca-75c4-4422-a6a3-f3abc71ebc3a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629155202, "uuid": "98b45b0c-c308-4d60-97d1-2bfa442bb0ad", "value": "taxve_198105476_20210816_089590042_30694.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be16d924-fe76-11eb-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1629107151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107151, "uuid": "8a824b2d-dc48-4d9a-b795-6e95da1be5e7", "comment": "Malware payload (OskiStealer)", "value": "0eab3ccc18c952cc89f73ba1a480070f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107151, "uuid": "f598c3cb-604d-4bab-947a-a0bc7d0f9b88", "comment": "Malware payload (OskiStealer)", "value": "c254079e9a75cb708e28deb9c72c77689c53425f8256338343c06285bed8ebbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107151, "uuid": "f0c9966c-ae93-4021-9b35-f721a01b76cc", "comment": "Malware payload (OskiStealer)", "value": "475b8039046cc7283ee3495aa8abc879679a860b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107151, "uuid": "84b6b85c-4344-413e-9971-900a779bc2ef", "comment": "Malware payload (OskiStealer)", "value": "23b1c07116a7e7b2484f73028ea966bca8efffc068ee13d0813ec644526cc798529b6586832569464f748fa4dabf2c26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107151, "uuid": "79bf0423-c50d-4ca1-a83c-98908f3dc08e", "value": "T19F55E63916B82767E079D335A6E44417B3E09C5BB225ED5DB8CA37A70232F4265C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107151, "uuid": "dd65c8ee-5c6b-4ad3-973b-c85499af746f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107151, "uuid": "8fb3a6d9-a36c-4ceb-a488-ad7b81ad3a73", "value": "24576:v2X1TrFY8blhBPHKFOoOxlVkqF2gZROak1FsGrQxQn9Y:OXpyQ1vxzxlPI6RE/Drh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629107151, "uuid": "d3238daa-09f2-46cf-98b3-a74802070e87", "value": 1375744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629107151, "uuid": "88bd8c32-2141-4f7d-8180-2ec75e2399d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107151, "uuid": "3534bcb6-6281-4081-987d-d6843eb1fc7a", "value": "Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad5233a-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629132244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132244, "uuid": "f9b9909e-e373-4080-8506-7c4c5828f41c", "comment": "Malware payload (Gafgyt)", "value": "7609850fc9a837e062ac6469b37f289c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132244, "uuid": "b333b0f9-dc6e-42c9-90ab-99437b0bcc7e", "comment": "Malware payload (Gafgyt)", "value": "c2cf1e3f6144c92381bb0bc3431394c35f0c24057b882f217785bfab942d80a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132244, "uuid": "e8084a35-5ef9-43e5-acd0-7c02e75f9203", "comment": "Malware payload (Gafgyt)", "value": "d58085fbfbc86a3f3f5c9a60230cd1a91a80cb31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132244, "uuid": "3e8082f5-5543-4f39-b2d6-01fae91b2470", "comment": "Malware payload (Gafgyt)", "value": "f1618ade2830ee5582424c5768190c43bb59c406794a9f46e763133917d979b430e2196980e320bf361f9a7ed161bba2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132244, "uuid": "bea48910-aef4-4e8b-8e94-409d369416ac", "value": "T14EB32901F9408727C3D327BAE78F479D3B355A9467D733116938BEB42BC2B992A39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132244, "uuid": "3cb1e741-fc61-4e18-8be4-de5024404e95", "value": "3072:5uo7o1QepP2khPe3r/17mPmkZrQAhPDCXFke:Ayep+khPmJmPmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132244, "uuid": "986adb00-0e01-4253-8b2b-a843faa88cc0", "value": 108419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132244, "uuid": "530a30c9-7bb0-49d3-ae99-f223e73d705d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132244, "uuid": "0102245a-472f-4028-a437-dd0ce88a8169", "value": "7609850fc9a837e062ac6469b37f289c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4de9ef-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629132544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132544, "uuid": "73dcebc5-6015-4ba9-a1b0-8324ebf8508c", "comment": "Malware payload (Formbook)", "value": "91ea1fd23a564a74b71f143b86968143", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132544, "uuid": "31463b68-a0e1-4e3f-89ec-a49298258240", "comment": "Malware payload (Formbook)", "value": "c35e2e17c0663fa4adc5a1b219f44cdf90e9ec8a68fe23bf65b43c0ba208dbcb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132544, "uuid": "0f487e68-6dd3-4934-8de6-b725c8b524db", "comment": "Malware payload (Formbook)", "value": "903922a4c4e7104dce009d9a01ddf062604e7f3e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132544, "uuid": "e5e9e406-79e0-47c9-989b-4bb4f73d803b", "comment": "Malware payload (Formbook)", "value": "f6cccd43ecc5685368ef44417ea8cfb229301795a3fe86a1e5df7cc0a732fee92d3a0f13a780e219a6d216c6b1776bb2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132544, "uuid": "0a36d949-cf00-4f7e-9649-87502bf0582c", "value": "T15E451225AA68478DCCD5213EA33F6300BB86FC579644D541397C39613E34E6829BEEF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132544, "uuid": "fdc170a4-2016-4174-af93-698082a0162e", "value": "24576:B1HW6JcUhQX8oVe1JZhfsINgawpoXeO/MZq9IIUpgDoqHhsAlMmuzxBK:WHqQXxVeTHdEpoXeO/MZQI9S1sAlaxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132544, "uuid": "d64714c6-ce03-454d-b56c-1c944c0e1ab5", "value": 1266424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132544, "uuid": "52049efd-03a7-4c3e-b177-bc69625da279", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132544, "uuid": "5117fa9e-780f-40ac-b8b0-ed0644c185ef", "value": "DHL SHIPMENT DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044b1150-feee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629158379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158379, "uuid": "8ae28b0c-c6b6-4f2b-be97-56c87c70e45f", "comment": "Malware payload (Dridex)", "value": "363b776030d7e85b68aa9f63ed08f590", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158379, "uuid": "f95ddaef-1643-41ec-b706-c4e3e1632ada", "comment": "Malware payload (Dridex)", "value": "c4719e80fe0dce2e24b0993e6045d03005336fa505f7da5c9ccf3eae51b47e53", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158379, "uuid": "032fa243-8edb-4c21-a69b-f3caf8ef2bf1", "comment": "Malware payload (Dridex)", "value": "3597f05917133adf524b24451ed4ce404dc922b4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158379, "uuid": "621fc847-b7b2-4704-933c-dbda1ebebadb", "comment": "Malware payload (Dridex)", "value": "0b29a8b47cb0bd916348e8c4c0e1bbbbba1dbbd70ce39ab7293611882dfd044fc974856a9505aa8b10db9e3e604c181b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629158379, "uuid": "1612f69e-b93e-4b95-8b29-2ec0c715b4ab", "value": "T12944022BD6A96C43D22CE3B73D0B157023424E47A31175CE2AA23A6F3E0DAB715F951D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629158379, "uuid": "f2e770c5-abf9-4c3f-917f-7373425a8743", "value": "6144:eogkLjLh9kNwQuiglkEz8KIYpOM+H/k8EE/yWgLWcUCyMxwHhk:vDLZieQ/C4M+H/8BWgKcUCyMO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629158379, "uuid": "d2f8d992-b825-4131-9eea-7105916f9ce8", "value": 271478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629158379, "uuid": "a3eee1ca-561d-4070-9035-e3c6678ce020", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629158379, "uuid": "50619755-9d53-47eb-b9fa-8926c8a26d9e", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.82328.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2952ece-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629132499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132499, "uuid": "f08ee177-50b7-4315-b8e3-5678471fec9f", "comment": "Malware payload (Gafgyt)", "value": "10d2ff6ec3dec78495be1edd9003aba9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132499, "uuid": "16dbfd7b-e892-40fe-be90-bc6fcdb3304d", "comment": "Malware payload (Gafgyt)", "value": "c5a9fc3b29182cd76a39a7e8deb251b5248074d125cb5e4d37ff22cd4a8caba4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132499, "uuid": "c1502933-33c2-419d-b813-04160f6351ae", "comment": "Malware payload (Gafgyt)", "value": "069f6d442c1c99ff754e24853a73b6b0e4227c0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132499, "uuid": "4d1ea930-0702-47f4-8419-4c1881848ba6", "comment": "Malware payload (Gafgyt)", "value": "526c42268899ae35c8167d3c034baa8fc254ae73858a0be993f92951623a43b4d5a82fa8aecd4727348ddc43d731f950", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132499, "uuid": "9f90e3df-01d2-4121-ad4b-e868c52da7eb", "value": "T14DC32905D5508767C2D3237AE79F465D37331BA893DB33215A34AFB42BC2B991E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132499, "uuid": "ee2d9fb5-e7c3-4e9d-978e-fc5a9cecbefb", "value": "3072:7N2Qnfb00DaCtLrVxDuY3m0GCyWp+mTQOY5NX3cn:7N2QjFDaeVxDx3hyWp+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132499, "uuid": "1106cd52-68b5-4db2-a5a2-4d2f4c2edca7", "value": 123537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132499, "uuid": "5de701c1-4b68-40de-a663-523d9343d132", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132499, "uuid": "7e2a3129-9a94-40e6-a584-6a8580c6d926", "value": "10d2ff6ec3dec78495be1edd9003aba9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941fd232-feac-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629130273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629130273, "uuid": "37537f70-255a-4a30-a095-a10d886d95ea", "comment": "Malware payload (AZORult)", "value": "463a3f123ba9918c888f6c78aa9c59b1", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629130273, "uuid": "12f4109b-7f28-455c-bad8-8dbe4c6e5ea5", "comment": "Malware payload (AZORult)", "value": "c6260a036327191e2139e7f346cbcaa2e076583253d07c0809959b08cb9959e3", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629130273, "uuid": "105b3e01-2f5e-4cad-bb10-92f42d1a1c1d", "comment": "Malware payload (AZORult)", "value": "21ddb18b7020200391156a58ce37f2af9010008d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629130273, "uuid": "fda31bf3-1029-47ef-be17-1db90822c7bb", "comment": "Malware payload (AZORult)", "value": "e47eced7e707e500686eb3343ded8fe08bd8806afc1e36cb4e3931b65755678fe3269122aa6f74be2f88997a0605e0b9", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629130273, "uuid": "73bf3ce8-7115-4e30-9334-2da2040589fb", "value": "T1C354173335A169E0E79B87B915DE8A911A7AFDBADB0266E78310570F20345F1807FB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629130273, "uuid": "4121f9a0-1032-49b9-b8d5-071ac6055a85", "value": "203155eae35de8bc342ac1f99413b1ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629130273, "uuid": "dfbfac24-bff3-4f94-b968-44554d778e55", "value": "3072:PU3YUTr1AgrGJxjYs+C9UO+fcYBS5be1NNtI9NHOPw+Hmr3oWy54waNEXh:gTr1vGDk3Ot5C1lc2w+H0o3QGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629130273, "uuid": "eedfb61d-9744-43d5-8b2a-ffc964943d3e", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629130273, "uuid": "13ad4a99-5eb1-4206-80eb-767fecefde54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629130273, "uuid": "23e4bd02-73dd-45e6-8239-f42363fb475c", "value": "C6260A036327191E2139E7F346CBCAA2E076583253D07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d9a2ed-fee8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629155835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155835, "uuid": "26af5bea-c37a-41f2-b71f-97a788c4715b", "comment": "Malware payload (Dridex)", "value": "b03eaae645175fee6b0f687c6050dddc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155835, "uuid": "2d21bf57-9dcd-4ddc-bd96-2c9ad8897b8d", "comment": "Malware payload (Dridex)", "value": "c7145230db673b23895e029db218f15a5f99e338f1ed5b842d2ef0ab61496b9d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155835, "uuid": "7411ae39-0ea9-404a-9cce-7b677e059aff", "comment": "Malware payload (Dridex)", "value": "9d35aa426118f0de3407e589a73b6cb6271419a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629155835, "uuid": "aff8e13c-7793-416f-8afc-420edb7a2c57", "comment": "Malware payload (Dridex)", "value": "dd11a4d3282bca01e5b66df0db516a756aa4360ebfe61d3ddc282f268977315d7a080c53f96f69f2e6d0cbb01cecdb0b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629155835, "uuid": "618f1f90-e0da-451f-80ab-0d2884c346c6", "value": "T1756402068677F674EACA607D9CEB2FDA17B09E1A36401E53B1D2D28DEE19CF7531004A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629155835, "uuid": "0f5db334-e6c1-4fea-a0eb-6e3d263486ff", "value": "6144:S+NSLcq+YXEsz1rqlvfGMklr2WfbeYh0HS64Swzp:FPYXEsRelmM4r56VHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629155835, "uuid": "c11262dc-f913-4e87-992d-2fb64da18eed", "value": 308759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629155835, "uuid": "2c6cd0dd-99b7-44bc-96c4-253a36433b86", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629155835, "uuid": "2dd9faca-2924-4759-90fc-cf4854a82be4", "value": "taxve_608919_20210816_51615_8126501.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ece4ae-fea9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629129065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129065, "uuid": "4bd3e535-7a77-4485-bc21-c5ca4b36da09", "comment": "Malware payload (Mirai)", "value": "b6b662ceec58ae1ab5e76cdefcdac690", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129065, "uuid": "738807bf-35c3-4fb5-8707-acc762a55151", "comment": "Malware payload (Mirai)", "value": "c8c3ef52ac675e45e0ab4b988832c0e006b724ac4d16afb2f63f92ddeeaf2482", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129065, "uuid": "e75e2a9c-c614-4ad6-a7a1-9b28b43ac470", "comment": "Malware payload (Mirai)", "value": "19390acc1914d6a031d7622c7c6ad246f16ab306", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129065, "uuid": "9cf78aa1-a439-4fc5-b0d5-926fa4232327", "comment": "Malware payload (Mirai)", "value": "dc2d72e025362fbfd9840efdec78fd4c48a8a4bd2b443a23f7bfcbc467a6327dc7480d6bfb95469181891d0dbeec2cee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129065, "uuid": "a1977116-a276-47ef-8415-cc97e2d177dd", "value": "T1BD237C73D06DADD4C20846B4A6358F381763A50083672EF65E8ACAA28447EECF5293F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129065, "uuid": "27a4889c-20ad-4994-adcf-ba38504d3851", "value": "768:FFANhCjZTMygsUQMMVj/x3c0qb5i1RC5oPMuCgi:FFANhyMyb1x3c0qViXV0uCgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629129065, "uuid": "f63c3cab-380f-4ada-94e9-71c014a63270", "value": 46776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629129065, "uuid": "b3364b8b-0a56-4a71-9964-e444fa54a476", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129065, "uuid": "3272f2a9-2536-444b-83fb-3db32765e36b", "value": "b6b662ceec58ae1ab5e76cdefcdac690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249fe14b-fe61-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Socelars)", "timestamp": 1629097874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097874, "uuid": "dedbfa9c-29ac-49bc-98b8-442ad149322c", "comment": "Malware payload (Socelars)", "value": "ed8353cf1e80cb6afd65dedd1f83071a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097874, "uuid": "d7687557-d63a-46b2-8939-3b73e3e6d4cd", "comment": "Malware payload (Socelars)", "value": "c8d28298cf83e95158d8eb811ca0251af61a866d3eb55447ce092dc7c79c0952", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097874, "uuid": "0f4a33b7-f179-4141-9c6a-2a5c3c1034f1", "comment": "Malware payload (Socelars)", "value": "dc6f6c65768d314a7ae739aa062289567dea8534", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629097874, "uuid": "ce6bbcb2-86fa-4cb8-9349-07ae06905433", "comment": "Malware payload (Socelars)", "value": "26576f7020763c61f0773337f0d0866aaa79b7187ae18ea9d75454f9ad6df176e1028695b1310acd9fcd89dc5bf43172", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097874, "uuid": "4e3880b0-768e-40e4-8eae-707f69cbfc7d", "value": "T19D659F21F6429036F8E310B686FE477E9D68BA21031454D7E3C42D6E9E709E27A3B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097874, "uuid": "48d744e2-4de3-4038-8dd0-e9ea924838bc", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097874, "uuid": "63de738f-237d-4f20-a119-011851f1f679", "value": "24576:PIVFA1pqtg/TnMbX0lwyh0FVmEByA1EwFYyOsFTceoCSPZVjQMYfsowP:eFA1pvTMbOwa0TmUyMYEh1oCSPnQMYEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629097874, "uuid": "98225a44-55ea-419f-a251-b2dc3344c2bb", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629097874, "uuid": "4270c24e-d83f-4e8a-996b-a8ac2a33af42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629097874, "uuid": "3918fdb8-6f71-4992-b045-bdf1a46c73d8", "value": "ed8353cf1e80cb6afd65dedd1f83071a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c63fed0-fe6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629103551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103551, "uuid": "4ef1066b-81b1-4075-bc90-3a3d9674759b", "comment": "Malware payload (Loki)", "value": "113c44dd9cf4851f50c0f9ba93877f52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103551, "uuid": "4bbf8e2b-7d17-4b09-84e7-a11d2ffd5cad", "comment": "Malware payload (Loki)", "value": "c905a0a831f688e4262c1ed829f22a286a47de8bbf954bd743f0173d58663cb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103551, "uuid": "f32efd4f-162c-4721-a48d-5a83f4b1ea40", "comment": "Malware payload (Loki)", "value": "2c79f70c4a65d46531251139980d2b9f49e1bb0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103551, "uuid": "adaffe4d-01c7-4014-a0a9-4ad8a99c724b", "comment": "Malware payload (Loki)", "value": "6b82adf7080ece7b53aa5141ccecb78d2f925f38e1782c23632da3542c90db3d55026f51cd2612b7fad1ccb2b5e26b27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103551, "uuid": "75750ed8-bea0-4952-8971-d763cbe8c5c4", "value": "T1E335B53915B82B27E079E325E6E44417B3E0A85FB225ED59BCDE07E70206F4265C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103551, "uuid": "31ff59c2-a03b-46d2-b251-28a8d976f716", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103551, "uuid": "bd7341ef-4390-41a2-afb7-840e33fe24fb", "value": "24576:qmJHlFYyblhB4H2u6N4RXcUoVzf/u08sVP:hyK1nw1Enuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629103551, "uuid": "219a35f5-6fe5-43ba-84cc-8f26c6a885a1", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629103551, "uuid": "e5c414a3-f682-4417-b115-b1e43b55852e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103551, "uuid": "36ac1f10-bcb7-447e-a6d0-287d1f7e032f", "value": "RFQ - ACGC Project in ABU ALI ARAMCO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3adc2fd-fee5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629154781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154781, "uuid": "b6d2f884-ca4c-423c-b21e-4aa974d616ba", "comment": "Malware payload (Dridex)", "value": "e27eda06ef954cd9ab1be697dd986969", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154781, "uuid": "3fa2c3db-fa1f-48be-bd1b-b6da6c92d791", "comment": "Malware payload (Dridex)", "value": "c9ad5d10d5b2cd9be221d57043dba717aa67a5567fa2eab4447fc459f673f8bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154781, "uuid": "b1dfa198-8f1b-422b-8dc9-45cc6d92f34f", "comment": "Malware payload (Dridex)", "value": "6a814e6e21ee27c9d057ed3ecc5c8a75261fbf4a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629154781, "uuid": "d089fbea-7dda-4d1b-bc92-7dfd1c7ee9f6", "comment": "Malware payload (Dridex)", "value": "f559ff636d333c87e6834272bbbad60b92f0d2c1d8b8339c2ce5974801a810fb5064095a4aaf58d949b9bf295efd3f43", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154781, "uuid": "5bf23822-795a-49c7-8dc9-874841d2091f", "value": "T17E44020119A3E2A4F5EB607A8DCA5FDC33B44F1F21D06B16B4D7E55EBC29DE22190287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154781, "uuid": "875546b2-c815-4790-943b-d3279a5e0b6c", "value": "6144:SCNSLcq+YXEsVj/RP79vsxr6TFdEDAaZU+0txQ:RPYXEs9RToGT0DAE0TQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629154781, "uuid": "3e72a03f-ae58-4c39-9547-a2714f385ca8", "value": 277811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629154781, "uuid": "b6cb82f4-e3ca-42b4-b327-b41aaa912865", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629154781, "uuid": "4f247ccd-b203-40a5-8a4a-513adc5d2268", "value": "taxve_12630_20210816_391303_4311749402.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ebe463-fe88-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629114974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114974, "uuid": "00b178ae-73db-45bc-8354-8fccff1358ae", "comment": "Malware payload (Loki)", "value": "55f7acf8b0f33ac5dd1df197d729fb80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114974, "uuid": "2df0cfe8-67c0-43bb-91a4-08c493bbfdc6", "comment": "Malware payload (Loki)", "value": "ce2c891adbd16120de425a04ba9c0891ca4e6d5fcb8e66d0fb5a45871fd5b091", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114974, "uuid": "23f1aa96-cb09-4572-81f2-de4b50811e28", "comment": "Malware payload (Loki)", "value": "74bdf471721178b0c9cf92fcef68ade04d4098ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114974, "uuid": "60c445f5-0f56-483f-9118-388af5ab1944", "comment": "Malware payload (Loki)", "value": "fbf7281df4c94d12d2b62d9c8836da641e51ad1db5a8fc75de5fc58364365c7637741798fa6f61a962dbb690410ad451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114974, "uuid": "6fa0d6af-bdf5-43fa-8097-5606a9c37287", "value": "T1A645F73A55783B37E079C336EAE44417B2E4E84FB260D959BCDA13AB0652F5171C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114974, "uuid": "f3588edd-1f79-4f7e-b131-d7ea25be6902", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114974, "uuid": "678ad44c-c026-4bfb-b70e-fd51f42cd9a9", "value": "12288:DSqjLuxmYv/JqZfIGbUJ8RIalhBVpyNFmRG7AjLeleX3y8zI4V6kXG1vMfuBymxH:mOm/GuIblhBbMAG7AjCgX9N7DXmx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114974, "uuid": "4c5d0bbc-9928-4bf6-af9a-ede9e901855a", "value": 1269248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114974, "uuid": "2c9aae5a-e7ee-4801-9e71-6c5e7de7e5bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114974, "uuid": "28753d06-3f63-4f09-af92-1b2d8c885cf9", "value": "PL0000000BONO-SWIFT.pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f658d73-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629104845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104845, "uuid": "6bee7ab9-d81b-467f-ace3-abd3b856c274", "comment": "Malware payload (Smoke Loader)", "value": "405ddfb635c6b65486f8b2498c2c761a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104845, "uuid": "639367d8-d290-46ff-88df-20bfc91421bf", "comment": "Malware payload (Smoke Loader)", "value": "ce2fe316faac707fdef9aed79c1eb348f74a538fb5617ceea0a003b964c146e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104845, "uuid": "80d2c8b0-9d66-4d2f-97eb-62d628bced51", "comment": "Malware payload (Smoke Loader)", "value": "d1112cf98d262cf2bec94691dbc89e0713ab5413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104845, "uuid": "a66f7acf-1375-4e7e-8264-eb600fbf1c2b", "comment": "Malware payload (Smoke Loader)", "value": "64dc424757be9e12456a1a5c5609b56f59a4216479ded681fe80917e20b599d82b1cb9fb3d4cca9206f5d7fe77f83be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104845, "uuid": "00a9d148-c61c-4864-83e2-66f1c7479c1a", "value": "T1E304AE2D759FC972C392303044B3CBACDB689B21DA53097B1798366E6F30EB0566635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104845, "uuid": "41a8e447-38cc-4d02-bd89-894c1e857d2e", "value": "bbd46beeb3d66413f1019ab26c173363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104845, "uuid": "fc1fffff-1598-49b0-ab58-3cc34f335697", "value": "3072:TRVL0h9DjIr+M/K+6A8cBND5Rgc/md2nZ7yz:PL/5C+6Ah2c/md2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104845, "uuid": "9dba2b86-07e9-4bfd-99b2-d71dd02c2906", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104845, "uuid": "5ecd43f3-771e-4046-a3cb-3de16c0b67a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104845, "uuid": "44af1a30-3592-4b5e-aa6c-22b1c26224e7", "value": "405ddfb635c6b65486f8b2498c2c761a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c8c886-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629134081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134081, "uuid": "d4783f9d-8e4c-4bcc-9467-7cd178cee1cd", "comment": "Malware payload (RedLineStealer)", "value": "ede690e47cd28b61c55b2a2a59dce3c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134081, "uuid": "519fa4b1-2bd6-4431-a759-237443262109", "comment": "Malware payload (RedLineStealer)", "value": "cecc0d25318bfe6b3f927d8ad5304c84e98c29142f243794619e6cb044cd4bb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134081, "uuid": "025b4e88-001e-4b41-9708-7eca4004ce72", "comment": "Malware payload (RedLineStealer)", "value": "2531f53b49e637c08f60b286f1b62359e2374c48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134081, "uuid": "7b826a89-815e-4556-866f-fc3bfadf2274", "comment": "Malware payload (RedLineStealer)", "value": "9cb20a07e046650d493d1823b32cadabec03b1d3457e3b60cbd7fffd40a0f62671cd8dbc528e2e6a73bb9a4d5be68766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134081, "uuid": "1550537f-5455-43f6-973b-c041447aefcc", "value": "T16554F1117590D872C481057C86A6FAE4EA29B910E7B4436F3B4A1F9F6F713E2B237709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134081, "uuid": "4120af13-2697-411c-b8a4-c8bbe56b7fc6", "value": "afa9d305770588dfca258b9c4b376c5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134081, "uuid": "9d193fd2-32af-469f-8658-1b916b9c060e", "value": "6144:WL7DHlZB6gGLSn5wADB4llzci1mh1llhA:WnDHlZXGLSn5wASrNQFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134081, "uuid": "473732c9-7a78-435e-9ead-bed8a7b6e94b", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134081, "uuid": "08eac582-7eef-431a-b116-8930549e96a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134081, "uuid": "ee883e40-dea2-4ad9-a480-f557417e1ab5", "value": "ede690e47cd28b61c55b2a2a59dce3c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a703f80-fe83-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629112460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112460, "uuid": "ab1092e3-a26f-4c5d-8dbf-167a7e6ca47a", "comment": "Malware payload (Formbook)", "value": "0113f54d084f560fbebe3e73141c01a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112460, "uuid": "837ddbe7-ae51-4062-94a0-d7396b6a02c8", "comment": "Malware payload (Formbook)", "value": "cf22ce4f2db96effa84c70504160296e478ab07442b2c1f9ebcff92783c681a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112460, "uuid": "bc6c3342-84ce-4f5d-ac72-b50be088c1d9", "comment": "Malware payload (Formbook)", "value": "c60f23390c0a6306bbac2e3b7651ae5827388825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629112460, "uuid": "6bcfdc2e-1d94-44c7-84d1-6dddfbe24e4d", "comment": "Malware payload (Formbook)", "value": "f956665d626646e49e8e8b260f01c55cdf0ae9b0e2d47092e46455cb34e7681c4693298fcf5f915e2919be1746537821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112460, "uuid": "cdb79248-6596-4f7e-bef5-7f87ac80e26d", "value": "T1C4F4BE385454996FC672A537C628EB00FEF349927232CD0A439BE6871F1B0435A9EF6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112460, "uuid": "84605a29-785d-41bc-97e0-7c34a319d41b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112460, "uuid": "247af800-46a2-45b5-8e8e-e0aaa48be28a", "value": "12288:tL22G/JCsXXBq3RV5L/Y3DHYMqjFMuOunL9Pwkkv2TahM7qLubg4yxfhEAXT7:B1G/PXohV583Enu989Ix+mTqbg42h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629112460, "uuid": "bc302f58-8674-463b-aa79-408d71f8bb44", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629112460, "uuid": "c64474b3-c0bf-4849-83df-8110597c086a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629112460, "uuid": "cc9977e0-1dc0-4cd5-920d-42169b8243a9", "value": "cf22ce4f2db96effa84c70504160296e478ab07442b2c1f9ebcff92783c681a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255ebb96-fecb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629143402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143402, "uuid": "5f42983c-9805-4c89-bb0c-cfa7ccd154c0", "comment": "Malware payload (Dridex)", "value": "054a63b8e3d051b989f7b74a6759c11d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143402, "uuid": "362c42d5-3acb-4bfa-8268-4c45a9ce9159", "comment": "Malware payload (Dridex)", "value": "cf636c62369a3e2eca769ae4ab012647fd05f7639f98d163fc203373d19dbe2d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143402, "uuid": "06dc19fe-3054-482f-b0a5-891bed87de75", "comment": "Malware payload (Dridex)", "value": "f5df5c8839f3f4ac1af1ef22132225e2e580c5de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629143402, "uuid": "857ccd1c-1530-4ae7-b725-c0d38b25cc5e", "comment": "Malware payload (Dridex)", "value": "067b10da488a39e99551f40513df41320e5a8a80011fe39d98e0b7d44e2aebe2f004f6370a50b3b4c0e211882f86dfad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143402, "uuid": "ba0dcc99-c58f-483f-aae1-4e2666bed925", "value": "T1C44402086503EA5DFA0FAE7C4CDF14B06F8CCDAE0500692F65E5E92CE6E06E55C1B18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143402, "uuid": "5c1961b0-729b-4462-bb77-bf072861d5be", "value": "6144:SntZbAPPimNA/kjoitk2OkcFTp7zAM7w+DRfNd2gDEzIGAU:KtZbAPDNAcMmBu9zc0fNVDQIVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629143402, "uuid": "e1c9fa97-11fe-445d-8cf9-744d208505d5", "value": 278590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629143402, "uuid": "23bfa434-7b50-4e75-8b06-8a3cb60493a6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629143402, "uuid": "284ed3cc-7269-4445-9039-eb9ce4238c10", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_208111.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8443d533-fe89-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629115214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115214, "uuid": "bdc1c47f-89d7-4153-9d1f-a5a575c3a5d8", "comment": "Malware payload (RaccoonStealer)", "value": "1dc89fc5b604f31481a49b769cc39a75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115214, "uuid": "9778c6e7-118f-4cea-869a-ceec334890ae", "comment": "Malware payload (RaccoonStealer)", "value": "d1195982518ce6cf57fb9926ff08920a54ac3ada4fa1d559e70b3410f4d62bd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115214, "uuid": "1faca9aa-fef4-449d-9686-3a4158b9d184", "comment": "Malware payload (RaccoonStealer)", "value": "2ccdce3ee99e2268878ba83232e233d3b7fd9914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115214, "uuid": "e2e3c321-8e48-4e40-8db2-baf7e96ac830", "comment": "Malware payload (RaccoonStealer)", "value": "5b1340fc3828bce6f12e07bc7f84073f36541a84a6eb9023e1f35f1a4675e69df72b0fbd9b25924a225675dd69664642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115214, "uuid": "5a5ddac1-4c1c-44da-851d-7781c673ffae", "value": "T15104AE2DF98FD07AC355313044738BEC4A69DF20DA63097B2799266E5F30EF09666389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115214, "uuid": "1bdd5dea-2a5f-44bc-b677-a4f8e72a812e", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115214, "uuid": "ea4b7aa6-f6cd-4668-bf24-cb1c2419cf0f", "value": "3072:KELTWW/LnT4tsApW7EM+MYkuaBNRoRNc/mvQZ7yq:nL1zTSp7M++ZSc/mvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629115214, "uuid": "c64d589f-4357-4efa-bb5b-d62883131f5d", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629115214, "uuid": "296789d7-aa52-4968-b199-ddbfe892b5da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115214, "uuid": "100680d7-8919-43d0-8193-5b51e4e201ec", "value": "1dc89fc5b604f31481a49b769cc39a75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cd4677-feb7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629135076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135076, "uuid": "27651508-5752-4440-a727-18c7564de108", "comment": "Malware payload (RemcosRAT)", "value": "d0e35038719cd6c35ebc5baff4f253ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135076, "uuid": "694af525-86f9-4253-a24e-5df6bd999200", "comment": "Malware payload (RemcosRAT)", "value": "d15365b3bf19a02bf5275f1ccfca8c653783ad5c5e8937bb3b0545f4c998653d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135076, "uuid": "db314b49-8a6d-4e23-9e69-4a61beb7c7ad", "comment": "Malware payload (RemcosRAT)", "value": "e8718844429a37fab6eeee50ab92607cd8457216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135076, "uuid": "7e684725-00cc-489e-a0ff-a68f7f65f01e", "comment": "Malware payload (RemcosRAT)", "value": "7e03fa1917e26a12362869a7ad74d8b78a81ba47e185cccba35dd2cc64287726c3965d2ba2daffe4b9c6edd7f538fede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135076, "uuid": "5a1ec86c-7625-44a5-bf80-d74461a27fab", "value": "T14FF45C20F69D9EFAD176673DCE2A07B1F9187E12666C209D3AF7BD1D6D3A6813120043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135076, "uuid": "782973ef-a48f-4b5e-9085-f48f256d4b9d", "value": "23820aba24c2be0acaa9e8720fdc4001", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135076, "uuid": "aa67d48d-18fc-4f51-b327-4956a15b6012", "value": "12288:4iH+k1z45HbkeuKwYCBt+e2vtarxy7dS2mivoQA:4iboHYeUuVAm7HA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629135076, "uuid": "ada8fdcb-0b3b-4fd4-b8ec-60f3d2b96fac", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629135076, "uuid": "904ef627-8215-4210-8c8f-c27cf1e8e85a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135076, "uuid": "4e914f56-2af8-4f81-8eb3-8fe061257030", "value": "NUEVO PEDIDO -765452629 (URGENTE),pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa172cfd-fea6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629127867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127867, "uuid": "1a9e6666-090c-4d34-bc12-d1aab51acb4d", "comment": "Malware payload (AgentTesla)", "value": "c3d0bdea7796534fc5c8aaa6e68f1f61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127867, "uuid": "d3ae8fdc-2f85-4500-8716-8eb4b917fc55", "comment": "Malware payload (AgentTesla)", "value": "d16a736bba282fbe9db2afb8227dc1400624117e80fbdd20075f79764c619490", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127867, "uuid": "a0a15d5e-d6da-419a-bf51-6369d6498575", "comment": "Malware payload (AgentTesla)", "value": "40925aebeda6f305a0d0caf56af02772c30abdbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127867, "uuid": "077f39b8-3c31-4052-9a51-e05fc4630adb", "comment": "Malware payload (AgentTesla)", "value": "e221e2d0658c04f07af4472da9af0a5bcb189c5b9ded216a90fd2fd688a5dd7a85833aae334e713f4f530a6e08610645", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127867, "uuid": "195f8ec4-a55d-4544-a864-ae40e68ba110", "value": "T1B645E73A15B83B27E079E365E6E44417B3E0A45FB225ED58BCDA43A70206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127867, "uuid": "93de208e-5893-4f27-8e05-a2c8e2f9e904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127867, "uuid": "d9d17f05-66cc-44f0-82dd-82864db02e8d", "value": "24576:c30wMFYXblhBQi090RndqpqhfBnQT0YbUn:Ryr1Bldzvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629127867, "uuid": "68557feb-b160-45d8-9357-e876ad690800", "value": 1197568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629127867, "uuid": "a2de9029-d6f4-4182-9659-332303b35004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127867, "uuid": "ef4bf659-0cd7-4939-bf02-5fc35d3270a8", "value": "Pokwitowanie transferu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253a5f91-fe9f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629124504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124504, "uuid": "ed33b12f-cf46-45f0-937c-f7f0295f2fc2", "comment": "Malware payload (RaccoonStealer)", "value": "11d57daf30ca3e02d82760025034d970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124504, "uuid": "9cab7d15-78a0-4c91-9a41-b3c7ec9d7bb6", "comment": "Malware payload (RaccoonStealer)", "value": "d303cc49119b3f27b904cc0dc168bb1c8cf45c88695dfbc850a595859625ac01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124504, "uuid": "4a757878-8c1b-45f7-964a-8714ecdda90d", "comment": "Malware payload (RaccoonStealer)", "value": "18dbef336c70b6fbe50926602b3305299c258848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629124504, "uuid": "ef9fa452-178f-4b9f-be35-6870fd69cddc", "comment": "Malware payload (RaccoonStealer)", "value": "4467fe3f2e5e6d09f3186a0713b098da6d5d2e072180b9e54ca6da7ffc13c8c8f030728b8d85c1ea886faf15b76fb8bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124504, "uuid": "b24f254c-8048-4798-b7d3-998ad7023a62", "value": "T1B114CF107590E672C49241348891FFEC9EA9FDB0EE60422B7B987A5F5F703E0666734E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124504, "uuid": "fd34077e-5b5d-48e6-9aa8-6bedd45a0c9e", "value": "1a43dad8615b89dc6e5d071c17cc8026", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124504, "uuid": "f36143f2-7024-4d28-9d0a-9e3407bd1f10", "value": "3072:jlDLCW+ruTAtvPER2/dJOsBNBNRmQuKT0yB3rrihFdoYWk:FLEAAR8R2/dJOkFli8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629124504, "uuid": "79e85618-4452-444c-a9cb-052ce3bd78df", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629124504, "uuid": "fcc09ae9-69fe-43a0-b052-094619242f5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629124504, "uuid": "200e8f68-dd38-4c2b-a14c-72a842054937", "value": "11d57daf30ca3e02d82760025034d970.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc84db0-fed7-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629148674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148674, "uuid": "6ae241c7-aaf3-4317-871c-f121b8ab186d", "comment": "Malware payload", "value": "0cc99a641ba40204b63b63cd03efc5df", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148674, "uuid": "c490fa3d-3848-441c-a497-b53608b2bf79", "comment": "Malware payload", "value": "d34dd26ccc1bfecc424566f0262e855d61581078dc342aa84038c02e8f2bd751", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148674, "uuid": "bb16b25b-3d79-480c-a37d-bf654d378d1e", "comment": "Malware payload", "value": "1f915582dd8f93b95e6fbf3748a9f4495be7345e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629148674, "uuid": "75b27678-e6c2-4862-a173-87b88af4491d", "comment": "Malware payload", "value": "517fc06311c1ac9a59df71c50e92e44af71bc70e760d813c90fefd55210ed830b57baf7f2cb9c3993b4f8d50a6a9fbd4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148674, "uuid": "f2565d56-e17c-4140-8c93-42441d4d54b8", "value": "T1B214D083EBFB72BBD0024CB22729963B6559D846CE58DDD5F592D216C073EC2502BE23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148674, "uuid": "cffb0606-fb52-466c-9ad5-3af2deef2f8a", "value": "86bd8478222b7f02b724c9321381bb0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148674, "uuid": "a9cf6133-1d55-43b5-a328-e57e12b4fcc3", "value": "3072:YWa3N1eqJ7cNe58per6JpynepWHVD9qMe402JYIUk9H8Iz83SWZ9klSC:IxwO/Spynep6VDcMeQeIUk9cI6h5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629148674, "uuid": "52b2ffed-57bc-4264-b5d6-a1c8eeab6616", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629148674, "uuid": "5d1d39ae-8df8-48d6-8abd-bf45a605a30e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629148674, "uuid": "66389292-aa86-4eb9-b415-d13e7fa97da1", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6cbf90-fea9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629129103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129103, "uuid": "356bb8df-d691-4365-80b2-1a85ba4b2930", "comment": "Malware payload (RemcosRAT)", "value": "d7a93d2d313c2d5dea66534e7f9599b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129103, "uuid": "658579a6-a0d0-4268-80f1-226074811315", "comment": "Malware payload (RemcosRAT)", "value": "d4c6f300ccf9337a10d13a66a2b6b956a0e6e9673741f9b88f5811beb3a62829", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129103, "uuid": "a2745f26-b662-4bc8-b1fb-f26de61bf809", "comment": "Malware payload (RemcosRAT)", "value": "f406e1711fcba250b862ad937ea8b7f859e425be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129103, "uuid": "d84e2a1e-b305-4faa-8b19-af7871546883", "comment": "Malware payload (RemcosRAT)", "value": "8daaedecb7d3ed63660518496a77c7a46bcf7ed286cd97676a9b8b365cdfb9ec5122439cfb3330bac7d3f2c78b705222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129103, "uuid": "b724b78d-c8c0-43d3-98ce-b9fcf499981c", "value": "T126056D219381C437C1A26B79FE17AAE4E4597F85343C18865EF87C844F3B9D339BA096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129103, "uuid": "f9c23e27-4171-4ecf-a7c3-151ab27105d0", "value": "1abe4551dd4f8ef04deab38d0027e326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129103, "uuid": "000bad49-4f0e-4827-bdac-c450eba8bf96", "value": "12288:WhxUck0fyI/Xv94r0umLKC+pvbIAsrxPj+o8wcH:WhGdkF4r0uvnDIFZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629129103, "uuid": "c6bbc451-9339-4c81-ad55-dfcfc12cbbb0", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629129103, "uuid": "572662b4-bfd8-41f1-8c45-7e641b67d9d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129103, "uuid": "edc7b72e-dfe6-454d-8965-6b656989b17c", "value": "d7a93d2d313c2d5dea66534e7f9599b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7d3fc1-feeb-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629157423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157423, "uuid": "64afad46-c44f-480f-a295-f118ede3c548", "comment": "Malware payload", "value": "aa5c3aa529d2ad5bf85d45e21408717d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157423, "uuid": "043b10e3-e9b3-4c4f-a748-2a551c3a6296", "comment": "Malware payload", "value": "d5259d936d2d201c64b8f8b8311e0eaaf9d5366058378a1f67ea14b287b69892", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157423, "uuid": "51ccbcab-13b3-4412-aed8-77c971492348", "comment": "Malware payload", "value": "bf49918fdb60f0b5be9a5e542a5a2510f7b2a78a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157423, "uuid": "db7b3d1e-6230-444d-a588-5ff87a912703", "comment": "Malware payload", "value": "22dd6ed4b2a75a429505a7dd8fcdf76322a800016585ca048ab7cdf163a1dc9f9dbb5f8eae2eaee39d08c97595396d16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157423, "uuid": "aea2ebac-ffbe-415b-a7a5-b02a93ced260", "value": "T100067BE5374FD2BBE19903F4DC29961BC260E7B14B10C605DCACA4FCEA13D1D159ABA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157423, "uuid": "7e6bc4a1-f447-45db-8ac1-0947107017e7", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157423, "uuid": "5c478b26-cb9b-4c87-b916-dacf560818da", "value": "49152:EEc8/eW/YTr9VfPl0OPaXba5Nry64kE00jsyoI2JX5gCu:EEB/eqyr9VfPl0tba5VyGE7DoI2d5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629157423, "uuid": "a74bda0a-1459-4d98-8b56-71924071da68", "value": 3897080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629157423, "uuid": "f93d265a-f8b9-44b8-889f-f859eff131eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157423, "uuid": "04ebd78f-aeb1-492c-9af5-0d059482b62a", "value": "aa5c3aa529d2ad5bf85d45e21408717d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52754cfa-feb3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629133170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133170, "uuid": "fceaaf3d-03cd-4fa7-8f2b-7877aadfe9bc", "comment": "Malware payload (Formbook)", "value": "90fb6f14a6703fc496ed9a3c4ea48610", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133170, "uuid": "28aa38a2-2841-4cdb-ad7e-bd942d83228b", "comment": "Malware payload (Formbook)", "value": "d52a6e8ae651e64eb221926af43f5bbcccf8555f2748a5a9e041a4dd5ed122d4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133170, "uuid": "dfb956ba-6be1-4c1c-828a-5d52d79a92a6", "comment": "Malware payload (Formbook)", "value": "84679ceb2fc5610a7e15151c8365847c25f69eb8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133170, "uuid": "14696fe4-3c85-42ff-ab2d-d8d064f42052", "comment": "Malware payload (Formbook)", "value": "9203dd31e36eea7418a7147c1131b0722b9adb5f935f4f036b12870d8d6ade495c2ff50a86f68ea6fe14dab330aec23e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133170, "uuid": "1fa15130-b7ca-45a0-b811-06fe8eebd924", "value": "T14D75084B746B5392C50F1AF018EBB52CD2687C8940DC19CA4C6296DF3C609EED395EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133170, "uuid": "6f06c333-ac4d-4460-9a4e-042f1760db68", "value": "1536:yNFXMFDRYYYYYYYYYp2YYOYdn9Rhf9t8WYdkUNFfKUdn9Rhf9t8WYYYxYIYYYdkF:f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133170, "uuid": "bda15b7f-796d-4395-8057-7712f3e97938", "value": 1672961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133170, "uuid": "c21cd6df-45e7-40ec-a160-cf921bce4e27", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133170, "uuid": "e9ac17c8-62ac-4362-ad77-ae6fef0f482d", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.16.11117.13704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185c66b2-fecf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629145098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145098, "uuid": "4c60aaed-22ce-4ef1-b4e0-92991ec77ece", "comment": "Malware payload (Dridex)", "value": "2639cacb819a3fce10f09b6182991157", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145098, "uuid": "bfbb8d9e-05b2-40b3-accc-09b4d0332908", "comment": "Malware payload (Dridex)", "value": "d5593b654583c19056ce8e930191030da35719929c823b225180305adea1308c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145098, "uuid": "0a41524a-a71d-43a8-a684-4c0d105f9541", "comment": "Malware payload (Dridex)", "value": "98362ac0eb0651b5c99842d6bbd80d6c8c57cade", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145098, "uuid": "bab633f2-a6d8-468c-977a-915e7f555bb8", "comment": "Malware payload (Dridex)", "value": "846616e29ec6ad0161bc2b4177663ac23eb20e7f88fe2fd55408de73d0b316457c4ff695261ad38534836ecf77d4c43e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145098, "uuid": "0e29501e-e330-4c35-920e-c8eecc90a517", "value": "T1C76402152967F0ACEE0F6D7D5CAD20313FC9DEAE0204A96F31E0B61DEBC02E65D19586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145098, "uuid": "fd2bbdeb-35d4-4acb-bd30-27ea9f1b4d47", "value": "6144:SetZbAPPimNA/kjoitkmVRGRdzWB49T36mDMnUizDlnY9Hkr2V5Cn3Lh:HtZbAPDNAcMORUAB49T6YezxY9HkrMiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629145098, "uuid": "260756eb-d1bc-4114-bd23-d0fa4569b56f", "value": 324127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629145098, "uuid": "8fa70708-9384-408c-ab73-eca2825ab886", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145098, "uuid": "a1f25210-32c9-445e-9982-08ad046fd1bd", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_1_14759.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761c7ae8-fe6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629103594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103594, "uuid": "0e097acb-5ca3-4924-a38e-3a1628feb8c1", "comment": "Malware payload (Gozi)", "value": "c144f0300a8edf883d20efa99df9c4f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103594, "uuid": "61dcabfd-565b-4e09-8a42-038e274a2fc0", "comment": "Malware payload (Gozi)", "value": "d5b601aede54caf37aaa50ee368c76fc659a9f764feb4a9cf7f2eb880ae3f631", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103594, "uuid": "9e5039a6-279b-4fba-be05-a1f8d6fec798", "comment": "Malware payload (Gozi)", "value": "1e46028ab42f62146b77658452c67002bb29b658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103594, "uuid": "31f9df05-0159-473c-a8e2-b955d27d5f46", "comment": "Malware payload (Gozi)", "value": "1a0a87e892b2879d23a849582a95e0b43f5511cc4fd5c58ea7b98d1402e71272f78803fea06c0a9b2cc4789825f9398c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103594, "uuid": "99a7d1ed-d728-4adb-a8cb-a9a0291a0399", "value": "T1CB244B6AA3E40595ED6BC5B6CE53D62BE7F274092B14D30F4370CAA66F17722B21C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103594, "uuid": "c26e6461-805c-4f73-9783-ccd9393bb3fb", "value": "6144:/HExb7VwvtKNbnvSxYNiyf+D3Lu3y5mH:cxb5wvtKRvSxY0G+D7u3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629103594, "uuid": "bf22700f-3c59-4088-9a04-e2034bbecce0", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629103594, "uuid": "b485d79d-40c9-4077-8464-48fd3e1d1ccf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103594, "uuid": "05cdf6ed-e385-4095-849e-eba70d5df789", "value": "21bfc800000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd00540-fec9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629142768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142768, "uuid": "cff79cbd-1093-4428-87ed-d1d38beaa62f", "comment": "Malware payload", "value": "52da2140adf61a581a49515b7ea7f5a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142768, "uuid": "7e79095d-3d5a-4b41-a2c4-eb6763b633af", "comment": "Malware payload", "value": "d5ee77d056d127caa86367bb46bc622ad1fe35ec26141c55e58b8b51325ef6ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142768, "uuid": "fc0d5c5a-12a1-4fb0-8d1d-03f6fd3367bd", "comment": "Malware payload", "value": "d93c1c077accb23ca932330d3a83930830596de7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629142768, "uuid": "7521350d-a31b-41df-b844-cd14b7710783", "comment": "Malware payload", "value": "4354c335c1cdc1e43b98ee6493cfb48b233597f55755df875a7c157828cba563a757f51572b98381fc3e268ec50dee9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142768, "uuid": "8e14c23c-4553-4d44-8e8e-130d5fc3adb0", "value": "T141643C13768A2DFDE167D237CA839346D6B370B40321831D23685EEA4D9B394AE1F352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142768, "uuid": "9b397081-a931-4231-baf8-9974a1b6e050", "value": "3072:xp//ilNzbO8QxMpVTkeucPvNO+P0rzXzrto1QeOLf9GaK/zltbW61UkY4upimqQs:ASIPmfrK/z6F14bmq/Sl4RY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629142768, "uuid": "a60a1c8d-7617-4e13-b551-62da13d223b5", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629142768, "uuid": "4a794d40-eb7f-4193-b2ee-6081854a59f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629142768, "uuid": "95d896c7-7057-425a-bab7-5bc53d411cfd", "value": "d5ee77d056d127caa86367bb46bc622ad1fe35ec26141c55e58b8b51325ef6ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe1fff4-fed0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629145856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145856, "uuid": "acd03384-8e03-40fe-8955-5501628ddf0d", "comment": "Malware payload (njrat)", "value": "a88675b6bd37faff8ac76d0b3dd15cca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145856, "uuid": "a744d363-9b88-404f-bf9a-4cd1fd019846", "comment": "Malware payload (njrat)", "value": "d628e7a54d5069605f2e2b3226818d2f3343973b87e1e4a15943c9792e7f1d97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145856, "uuid": "b0844232-c828-4a3d-966a-11930d98221d", "comment": "Malware payload (njrat)", "value": "acca891f9da218eaee8cc79ad22909efba3575a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629145856, "uuid": "b0e96b5a-9601-43b6-975a-d9691886e3e8", "comment": "Malware payload (njrat)", "value": "8408343322142f49e9610c11fbb4f62197c3cd9b72f0a46eec8c5161054eaeba28d7446c1d5f84662cf02e2e73e4b1a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145856, "uuid": "9122e91d-2a77-4600-88cc-2f0db84817f9", "value": "T10CC2F86C37B68232D1EE067E5562EA5042B5D44BF227FB0E0CD958D94B1B7CA0B42FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145856, "uuid": "ec9edae7-ff38-4046-9b4a-739e4bef0397", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145856, "uuid": "5943965c-f003-4b2b-b6b3-ee7a636798de", "value": "384:TLMi5SRvT/nmgEiKB5jHw/SORsP5emgMlAQk93vmhm7UMKmIEecKdbXTzm9bVhcf:3MOdt5oYlA/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629145856, "uuid": "1b7992b8-53b4-4309-9386-be8a53d6fca9", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629145856, "uuid": "33bcfeb7-0dc2-4f1d-81fd-5bfc4a7ea918", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629145856, "uuid": "8765e284-571f-4baa-be8c-375758f0ce4f", "value": "a88675b6bd37faff8ac76d0b3dd15cca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0e3c60-feb7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629134823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134823, "uuid": "8a924221-c630-490b-a07d-e9f7b50f229d", "comment": "Malware payload (a310Logger)", "value": "a97ccd364ed034769bd7a0e41d823ebf", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134823, "uuid": "d062c6e5-e790-4077-b1f9-c8b5b00fac9c", "comment": "Malware payload (a310Logger)", "value": "d6390558e6f860877f95e6cf83ebc2fa028da6f469d75f73b27afe92900fbc7f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134823, "uuid": "859c91e1-4bda-4b3a-93dc-1102f882d22d", "comment": "Malware payload (a310Logger)", "value": "ca4e9380a6ac5fe37d204cc055fb7f63cf764383", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134823, "uuid": "0275e961-a3c4-41a2-a483-234634021b21", "comment": "Malware payload (a310Logger)", "value": "cff753b4fd64a8e9dd07d08e0533cd9c902938e282d21ab3e010318307320180ff9389cf308fec44acfdb42011ada723", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134823, "uuid": "14479afa-99c6-4e0a-b576-0ec333ab1534", "value": "T16FF4E17EA6A306ABF18810F45E956D7CE081BEB412DD90BA30FE796F4F1A790CC45E41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134823, "uuid": "9d2b2ca6-8217-441b-9a35-876ce5ba2c1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134823, "uuid": "0f1a5338-40d6-4f5c-aeed-9be2b85dd397", "value": "12288:Nte7/9xRNdnCGjIz8L4frvaRHELXq24z3P8cUdKFoUU5Czd0/FU1F3:uf9nXIoL4frSELq1LP84dU5CJ0/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134823, "uuid": "65e944b5-c925-47b8-b665-7a1609b30351", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134823, "uuid": "f8ffa6ee-65ed-4710-8b04-dc9e6642ebc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134823, "uuid": "32afe11a-3866-4ce3-b40c-f4d879744d5c", "value": "IMG_010326075200300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37a6824-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629126031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126031, "uuid": "2b931968-074b-428a-91e3-f46856b5a71b", "comment": "Malware payload (Formbook)", "value": "4ba7722998bc6777198ae909b978ffa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126031, "uuid": "aeb25ed1-2c60-49ef-a3da-b29965c7a84f", "comment": "Malware payload (Formbook)", "value": "d7093fa328a687b59a564019e56e3983e031d00327d7e5876c940c6c5b80bdef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126031, "uuid": "55a9b18e-b6a5-4cfc-9c6f-e190845473e5", "comment": "Malware payload (Formbook)", "value": "b1e9a55baaa7b68e8c1e640997f6ce0441c972c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126031, "uuid": "4fad8d67-6a9f-40c6-b101-a10da67b1d8d", "comment": "Malware payload (Formbook)", "value": "a892b2128a45ee27adc258e0eeb7b588456ba48dc1a6172b4f11b37154133cc10091242d2738baa1f0451c5b0d481599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126031, "uuid": "b4b7192e-f47e-4ce1-864e-fb518d7ac15c", "value": "T17925B23D2AF92627C1B6C379CBE59827F04498AF3415BDA698D753660343A8735C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126031, "uuid": "d9a81c48-372b-464f-89db-6b87e76a0421", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126031, "uuid": "6ba02c3f-22d0-45ce-ac47-3df724c9ee18", "value": "12288:PgAxquoAP7AwVtMBSvj5XAbYp7lCtBdTiFkZLczaTpoa:lquoAMw/MBSrGElCtBFp9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126031, "uuid": "ddbafe33-45e8-4198-8856-b98c603de6b4", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126031, "uuid": "692e3ac8-544d-44d8-8c42-0c2be7a30422", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126031, "uuid": "3ac510c6-24d7-4cd2-959c-6f9fc8e89898", "value": "Quotation 85663455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1aae171-feb6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629134698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134698, "uuid": "dd4294b5-005a-4d35-b4ff-46019bb187c5", "comment": "Malware payload (Loki)", "value": "f064fe9a93ece8f472cbf5a748978cd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134698, "uuid": "08faf140-9a87-4bda-902e-6d9df88e4907", "comment": "Malware payload (Loki)", "value": "d74bf61fcd9a1ea2743d24f4c418606c1d294fecfb5ed4c9634facf974dee7b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134698, "uuid": "73b351d4-9ecf-4e61-9d80-13c6f5ed8e38", "comment": "Malware payload (Loki)", "value": "c151625873763bcfd6e8f1bd70ffd3839a444fb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134698, "uuid": "547432a0-e20b-44f9-a068-4a85a4044f97", "comment": "Malware payload (Loki)", "value": "9623459198e5d28d50fc3a826d92d861283ffd2d2ae8e6ffe74d3c906d1e1705b1b239931c218b9099aef3266e38a110", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134698, "uuid": "c5e9e6d5-15f7-466e-8117-f24e23eaa137", "value": "T126C44A7D3150B9AFC137CD36C4580E15F660A8A7A3CBC613E0532959D93D3AAAE442BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134698, "uuid": "b14156f6-14d0-4ca4-8d49-5cfd45d3eb5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134698, "uuid": "63bfd1a9-c395-48bd-84dd-6ec321512f90", "value": "12288:0ERs+eAn1O8Ukr1YT8025XVN/xL/DltrPP53XzM5yHLhFSS3cK:1yZAziV21VNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134698, "uuid": "9f208f7e-3fae-47b7-9876-9d2fcfb01343", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134698, "uuid": "d5e87e38-1151-413f-a82b-d24b46b78c96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134698, "uuid": "013c2219-c1c1-4d73-bedb-72cf3641f8d0", "value": "Nuevo_orden.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec03d2c8-feb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ModiLoader)", "timestamp": 1629132568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132568, "uuid": "ebce9ca9-d5f4-4698-93b6-a863bb9935ee", "comment": "Malware payload (ModiLoader)", "value": "fd084269903ab4b2354aabb96cf46764", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132568, "uuid": "e9188838-9ed8-4c5f-8c0d-b421a8940113", "comment": "Malware payload (ModiLoader)", "value": "d764c472456716972abf910c9568dffe1301cee889b69f5fee31521bbc950255", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132568, "uuid": "36c68d06-a9d7-4d9a-b88b-82c38a1647d9", "comment": "Malware payload (ModiLoader)", "value": "4f1ebf3cf19d8eb1a53b50bd4eaafff005c628cb", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629132568, "uuid": "785dbb0d-d1af-41ed-b9eb-256c62876c54", "comment": "Malware payload (ModiLoader)", "value": "8021f2e970a0fa8b72baaeb8554913a26039a3b88158e03a97ed70bf666d4f5128db0ccb7ab0102dc320e402089c6426", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132568, "uuid": "7bda395a-830e-4819-9b74-82a312904c93", "value": "T1AD45238FFA914A12F6B254B6229E50456891CC8B37DD0C4E9B3E721FB77C43DCB2A254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132568, "uuid": "e2d8deb8-54eb-4c20-bb4a-e89a4cc1ed51", "value": "24576:7sCYHH8+Sl/IV4sbbJ27F9QST86Og9xLvwKRs/WCBwH:QHcgGsPE5ZHOg9xLvwzWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629132568, "uuid": "359cbe99-223d-4b6f-8a3a-476e0fa3956f", "value": 1265352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629132568, "uuid": "187d99b9-4973-4786-851d-78ffd5758d73", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629132568, "uuid": "b042927e-7b2c-4499-8fbd-c3c138f2f46c", "value": "Quotations.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064597ec-fede-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629151510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151510, "uuid": "f4b84941-15b8-4c5b-8520-6a0f3f5b6996", "comment": "Malware payload", "value": "fa98ed9794e56f5598319a77831d6339", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151510, "uuid": "a225b05d-67af-43b4-a1e7-e04554ca678a", "comment": "Malware payload", "value": "da2ecefc454007a958e88519df581885a05a3abe4bffa99d55d8fcde87362ca3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151510, "uuid": "34c2bea9-e44c-4def-a832-fbe23e322a38", "comment": "Malware payload", "value": "fc74a178c11b7febc604fbb1980baec996bd6f03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151510, "uuid": "02c55eb0-a2ce-4b23-a9a3-0b4df976e9af", "comment": "Malware payload", "value": "15d1e4f06bd4410d01a6ac5c89b18bb517022b5b1e97557547ab20d11d8b99ad7933c3bae34ecccedbdb71f5f1be1d04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151510, "uuid": "e85246b3-fe21-46ed-9d48-0127f5ab31c6", "value": "T112553C3CCD74FB56E035F378A6D4450FEFE09C5AB220D91969F537AA0635E026D8222E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151510, "uuid": "af081053-6b33-4196-9611-b51a7f553cd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151510, "uuid": "b6f165c6-3650-4048-85c8-abbfd6f6a688", "value": "24576:mlYMYHStVFnmblhB5sYnJNKyRIuhwlTPgpxi3p:4uaBW1uYnXzmlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629151510, "uuid": "5d4475b1-794d-41a5-a007-3c16fdd932ff", "value": 1340928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629151510, "uuid": "74992a34-dc52-4322-ad9d-33a0d280fde7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151510, "uuid": "2f1f8b05-8f5e-4a38-b51e-3cfd5d0f1bf6", "value": "fa98ed9794e56f5598319a77831d6339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4706b9f3-fede-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629151619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151619, "uuid": "9213726e-9c5c-4719-ae4e-60050cc1a093", "comment": "Malware payload (Dridex)", "value": "94f72cbce43f19320c2cdcd981d78710", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151619, "uuid": "ef4f60e6-1ff2-4a86-9906-0bf3ddfa532e", "comment": "Malware payload (Dridex)", "value": "da3ad91b43ca711ba9447ec1d4f2d4f92b6d1b9fac4cad36df28c0eb25cb6361", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151619, "uuid": "80ddb8de-c9ec-4681-95ad-965c3649d254", "comment": "Malware payload (Dridex)", "value": "5fe0b23eb3f12eda6d3204c04cc48cc82e97a4f1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629151619, "uuid": "d5eec186-4135-4418-b77c-8296f3c3dc29", "comment": "Malware payload (Dridex)", "value": "1b57e1a2141a9a4202466163b5091c9ae945cbd5e9449f6b03fe7d86a9714c9e0bbf1d1b1e6fe3a9f147127b05ceaba1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151619, "uuid": "e3bd5fee-1129-4c5e-8415-d575aaf02205", "value": "T1C144015A6953F91CFE5F6D7C4CEF14B43BC9CDBD0A006A2F51E1960CEAE43A65C28086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151619, "uuid": "f265659d-4518-4d9b-896d-6e5e5a3dc0db", "value": "6144:SgtZbAPPimNA/kjoitk4tEF/O8X/YWUeUyrrs4Ubkp4sWcRcMiFx:ntZbAPDNAcMoq1PYWN7s4UbtUcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629151619, "uuid": "2110f8d6-5034-41f6-a629-c1584104a0d9", "value": 259982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629151619, "uuid": "b309fcca-e197-4b60-a1f2-1e413f1134f2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629151619, "uuid": "b0426030-12ca-4e2d-84ed-bf19f1a2a6a4", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_2443320605.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080fface-fec7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629141635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141635, "uuid": "5c104888-42c0-4431-bae1-3081096408f0", "comment": "Malware payload (Mirai)", "value": "0e9990406f5aaa886b5e568bca918c6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141635, "uuid": "5cf6670a-6023-47f1-9338-38d5fc498a48", "comment": "Malware payload (Mirai)", "value": "da95000771dbc400823e0d0b9a19756df1344bc766f1798deb4794827b7cab9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141635, "uuid": "0bc1bc9b-a90b-47ce-990a-d97141cfa97d", "comment": "Malware payload (Mirai)", "value": "a17b0bee329bd63bdcbc240559d859617012bb3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141635, "uuid": "e53dfd1a-e903-42e9-a32f-f0e21065eea9", "comment": "Malware payload (Mirai)", "value": "f5112bd0056e5cbdc34d84cba3909ad82729e8e21ecd0a32abb3db200b08101229972383e4b41ddceb58c79478a0a20f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141635, "uuid": "561abaa0-1692-439e-89ae-7c0251bf0689", "value": "T19D6402CBEB51BC7AFD9A87B025670B1A77F4D5D9D2C3A580B36885443CBE241E7502C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141635, "uuid": "9d3d7752-afd2-4bfc-8cf1-e1373ccf4eb5", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6cola5POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZnc1PqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629141635, "uuid": "57c64fca-93ef-4d57-a459-8d97abab9644", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629141635, "uuid": "44a6f610-9bb4-4a05-b014-b713f9933174", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141635, "uuid": "26d89810-b78c-4c52-ac9c-c598f2e01acd", "value": "0e9990406f5aaa886b5e568bca918c6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028e8567-fe78-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629107695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107695, "uuid": "57d610df-04e1-4ee1-8040-d9c080c22941", "comment": "Malware payload (Gozi)", "value": "5fc9c9a1351c50f946976d66a0ef062d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107695, "uuid": "fab97f46-41fb-4819-a620-b1a83fba364a", "comment": "Malware payload (Gozi)", "value": "daa77f845e3af70c6bdd9bcc6c49db72c6b26e7799feae5d8aaf6044f6de5086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107695, "uuid": "36cfeb59-1849-4706-be5f-9b8d0b09c78a", "comment": "Malware payload (Gozi)", "value": "e832749565015fed703bf3556d36aeb0723be94c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107695, "uuid": "cc61bcc1-9304-415a-adcd-3149fc9c24a4", "comment": "Malware payload (Gozi)", "value": "f40b56289fb44710bad6b9a2e3fc83329db81b30ecb8b4de88588c476b99a09e710788d83810631ce64d755f18ba0b34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107695, "uuid": "3b4c0054-6431-4ed6-986d-6ac6a59d9ad5", "value": "T13D347D6AE2A40A95EDBBD5B9C993C617D7F334490B64C74F13B0CA5A6F53321B21C382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107695, "uuid": "5b1c6038-865e-4891-83de-293f1e23cfaa", "value": "6144:tmnZO0GDlypHAT/cxkDyPFXkfh+3m33c51Wjak4SaS83x:tMZOrEpHAT/cLPF0Im3s51WjaC38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629107695, "uuid": "ae8d8f5b-7db7-4c9a-b7d5-5166e031dfc2", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629107695, "uuid": "38caa1b7-205d-4128-97a1-1f3e08bee46c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107695, "uuid": "34e617bb-b895-4d42-bf3a-148a43278b23", "value": "1f26ef70000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1445909-fec3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629140227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140227, "uuid": "19a7f170-5706-4e5f-853a-44eabb8e025a", "comment": "Malware payload (Dridex)", "value": "384965395d191f40adaac4566b07973c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140227, "uuid": "f30249f0-f29f-4e29-8dd7-c51766c423fa", "comment": "Malware payload (Dridex)", "value": "dc5987a650cd86daff6f68088cac0477cd90ee752f53f29e53b86db76ca4ccd6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140227, "uuid": "707960c4-bb85-44a6-a4ed-47756c9ed253", "comment": "Malware payload (Dridex)", "value": "0dffcdff76b8aa1f4499074607898aab086f1f6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140227, "uuid": "f96c72b6-d0b5-47b2-bc78-384fb362c306", "comment": "Malware payload (Dridex)", "value": "a69adfed876d583411bbedaee2aa688058c8716711d36386b150c2fb12991c0539ba14e5de03eee08128081cfd5640d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140227, "uuid": "374ef9ab-03b5-4702-8ba5-2602e6c77876", "value": "T19B64022B5477F064EA9A407A1C9F1FEE37A08E7F61903709F2E4A51EFE05DA320945C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140227, "uuid": "0389649f-784a-4068-b34f-afffd29f5514", "value": "6144:SqNSLcq+YXEsMcTJuBHrZdProzBpkfeyGsiwLjkwPs2f3e1s+fScMp2:BPYXEsl9WFNQBpfyqIkwU2fmG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629140227, "uuid": "ee387fa7-9296-4da0-9290-37859d73fe52", "value": 311960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629140227, "uuid": "e197db03-3055-41a4-8ed6-31222c861102", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140227, "uuid": "b499e700-c667-40ad-8ea9-a6737cac5d33", "value": "taxve_5054041145_20210816_722490954_2368397.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e22f8b0-fea8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629128357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128357, "uuid": "9d337181-4de7-4fcd-b01a-a498217b244f", "comment": "Malware payload (Smoke Loader)", "value": "d72f175456ff83f6ada507bb5903fb00", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128357, "uuid": "51665a0e-3d1e-438f-92c0-eaf18614b80b", "comment": "Malware payload (Smoke Loader)", "value": "dc99c52dc9e81adde22cc958053e11bd63605cb90953d86d75a9896d585a17a0", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128357, "uuid": "861ce6c9-706c-40ec-ba1a-93b0fdccbcab", "comment": "Malware payload (Smoke Loader)", "value": "51e445724b8f9d5587b8158ad3db421ff5116cde", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128357, "uuid": "014d96aa-3eae-4d36-a59d-6ecc104a3293", "comment": "Malware payload (Smoke Loader)", "value": "20c144d6c52680675ab65d075218a59057a8f7a0d5ea7f39ec0d8dc7b8820949425c42683edc8233586a16e93346fbbb", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128357, "uuid": "b213a131-21ad-4a6a-9b6f-7ccd6dac6aae", "value": "T19714C021F9A0D5F3F4D6013804A2FAE05AA8FD75E650065B27983E9F5F703E0563A39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128357, "uuid": "aa0db879-7ba1-4da9-8287-9ae46d62f369", "value": "32eca4427f106c548c06ec4f87d7efd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128357, "uuid": "facc37e9-1e58-400d-bffa-c4909c4d2940", "value": "3072:BnO59tS1XiKO2vzu5ArBN8PR3QuKT0yB3edoMZ6P3p:Bh1XvBv7lFMAP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629128357, "uuid": "590864cf-12bf-4303-af6c-da96582d5c19", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629128357, "uuid": "573145e6-377e-44ac-a3fd-7d3997af6f03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128357, "uuid": "2f777cef-ae2e-4be6-af37-f25056229e33", "value": "d72f175456ff83f6ada507bb5903fb00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be431ca-fe5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629095470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095470, "uuid": "9dbd943b-0f1c-4720-ab01-ce40dd5ef62d", "comment": "Malware payload", "value": "1010bec081572dc3bd16e26a1e37d815", "object_relation": "md5", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095470, "uuid": "88557020-b620-41a2-a6a1-276c2dee0c15", "comment": "Malware payload", "value": "dcc4ac1302ac5693875c4a4b193242cbb441b77cd918569c43fe318bcf64fe3d", "object_relation": "sha256", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095470, "uuid": "13060890-6276-4392-a178-ae1964d70d53", "comment": "Malware payload", "value": "bfc0219efb60fb270cee0b7b102afc0d4b0a121a", "object_relation": "sha1", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629095470, "uuid": "6e10b9c2-ef87-4fe6-b4a8-66fd92248e49", "comment": "Malware payload", "value": "b3f5446ddd4539d193d53d10ae876ab740fab2decda56b2c3c692f37a5e49d534a14f16a049eefa8b5ed0aa0a153a419", "object_relation": "sha3-384", "Tag": [ { "name": "Data Exfiltrator", "colour": "#908DDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095470, "uuid": "921b5b6b-3792-459f-b3b5-aabdc753812d", "value": "T190F2A443E5AE90E6D4B9C036A5577B2BF8F17C914034AB3BAA904B5B1763B30F91E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095470, "uuid": "7b5822a9-e5c4-40ac-aa85-61bd8bcc0853", "value": "85ce0801668e488873e72eeb306503da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095470, "uuid": "a084ecc4-995d-46e3-836c-ff42dd290315", "value": "768:ycscKP14scGOqEMQcanOPBbEbeFpUGC/YDR5Ws:yV3cGOqEMQcanOJFpUGC/Y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629095470, "uuid": "5f83e183-57f7-480a-b08b-9ac6c80e3367", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629095470, "uuid": "91ba6107-7059-41ed-ac79-fdab882bfdac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629095470, "uuid": "404f7c83-857f-4909-a55f-d6dbc0628d59", "value": "dcc4ac1302ac5693875c4a4b193242cbb441b77cd918569c43fe318bcf64fe3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe7ad67-feb6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629134669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134669, "uuid": "bbdd5d15-902d-4dca-9c50-141acf1f0aae", "comment": "Malware payload (Dridex)", "value": "cfee648208634c4fe5201d3574bc7e5a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134669, "uuid": "fb0e1107-b2f7-444e-b95a-8a36729b2ca0", "comment": "Malware payload (Dridex)", "value": "dddb5591ca031d06cf0778ba22594d46a4ab09f285027fe55e01297838e714de", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134669, "uuid": "d5b82a17-5ba3-4e04-af2a-9c30b6514822", "comment": "Malware payload (Dridex)", "value": "44ce889559c8bea258994fbfab5f9192182f103a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134669, "uuid": "ed1df5d2-c1a9-4967-ac40-99f6861512b3", "comment": "Malware payload (Dridex)", "value": "9052d6c9904639de3d3db1649957060dbb38e0dd4c5f66dfb25bd3a1caef099479161ba577eb135e92a361023f180959", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134669, "uuid": "9f64d316-92a7-4ca2-bb46-b58ec72bb201", "value": "T11444F1161967E65DFE4FAD7C4CEF1570AF9CCC6A1A00253F62F0A54CEBE02D02E25585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134669, "uuid": "062d237b-1b34-4065-8f91-16ce5c195f6d", "value": "6144:SbtZbAPPimNA/kjoitkJmkj9qppi39LIRiyjgWihbCyBz94u37:otZbAPDNAcM5mkj9qa39qisihPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134669, "uuid": "95a94203-f8e8-4814-a204-930ee5781e8d", "value": 257865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134669, "uuid": "8fc49fda-d0e3-4959-a649-6f7c94f1a675", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134669, "uuid": "24ccb71f-8399-40a0-b05b-48d6e1239339", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_0263688.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fe5f33-fe6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629103591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103591, "uuid": "553d5396-424f-4ce3-bbbb-b5622922e20a", "comment": "Malware payload (Gozi)", "value": "9617c02428e411345eb144feb0dac775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103591, "uuid": "514dcf64-f967-4305-ad11-6820e7d1cfcb", "comment": "Malware payload (Gozi)", "value": "de7c0b7aa3009905f81e7d2dbf9a715c6f2d8503f8c5c946ce156fe0f7529d0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103591, "uuid": "a8602668-cea2-44ce-a225-10861e3126e3", "comment": "Malware payload (Gozi)", "value": "3b18bd2f81b749f2b4f2bed6cc1d60db7d434ed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629103591, "uuid": "64b411bb-8919-41a1-87b0-fabca9dc6db9", "comment": "Malware payload (Gozi)", "value": "e0d6c6d5e8448fe885533af256d51231edcb9860735d28baf78d55514112b25d167cee19de314de2bb0e901253a276ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103591, "uuid": "6f9e7de8-4dd3-4dd0-8f6d-aa715170ba5a", "value": "T17A346D6AE2A40A95FDBBD5B9CD93C617D7F274090A64C34F23B0CB965F43321B218396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103591, "uuid": "0d0b9b06-f068-4107-8c3b-4cd31863bfcb", "value": "6144:arezMySF6ymJNNDgq2L4LlcwFhR2hMX/DWEWk4SJFr:arc4FxmJrr2LicwlcMX/DWEWCJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629103591, "uuid": "2879ea00-e9d9-430c-a8bb-b9464d36467c", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629103591, "uuid": "818a6769-34a5-471c-8f58-55805293bc22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629103591, "uuid": "a594c648-1b8f-413b-825d-0cabbf048d02", "value": "20b4f610000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb8543e-fecd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629144461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144461, "uuid": "034afa8a-4d94-4e40-825c-cdd29fb51adc", "comment": "Malware payload (Dridex)", "value": "f231e4902c9ad546d75482f4e2e95b9f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144461, "uuid": "e3fa4a7d-7a8a-40f7-81d3-c09afcbaa0a8", "comment": "Malware payload (Dridex)", "value": "dea001cf8cf2cd2925312752a72b42eba054a0f5c67918bad6e7eebaf3c2e5d5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144461, "uuid": "388d3b46-51a1-419d-b28a-5312003bf69a", "comment": "Malware payload (Dridex)", "value": "07d8b8dc13a829ce10edbe25d2195dee4fdf20c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144461, "uuid": "a5c2a646-42db-4559-b607-8ad32baecb71", "comment": "Malware payload (Dridex)", "value": "bd8a3bd5c979a826b12f3e47178a653ab0f08fcb0452cd8ff393e5edcdf795de0f4b350e36ceaf46baf7fe07745cad4b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144461, "uuid": "87b07770-8d87-4ac0-b3de-4d75a3f8e1fc", "value": "T1274401496653E45DFA9FBC3C4CDE28B42F4DDDA90500692F26F1A56CEBC03C68C6A0C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144461, "uuid": "24d66b26-1fcf-4d00-9f96-b770d3c305cc", "value": "6144:SAtZbAPPimNA/kjoitk0Bk94E5wZCctiZSt9Z8UlgljmafRx3Ny1G:VtZbAPDNAcMH94ywZCc0ZSfZHMRx3YG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629144461, "uuid": "2641e086-b9c1-40b2-b2ac-83cfb91ceb3c", "value": 277414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629144461, "uuid": "a27be6a2-814b-486a-bd46-39bf3c0cc76a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144461, "uuid": "50df8c55-57cb-40fe-8f5f-30e6db838d0b", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_6_4997603.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7054347-fea9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629129070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129070, "uuid": "8c0f23bf-14e6-4428-9980-21c754f3e196", "comment": "Malware payload (Mirai)", "value": "a1a298447a5a839777ba414979f4581a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129070, "uuid": "296e8739-70bf-4d17-86dd-d4182f09d302", "comment": "Malware payload (Mirai)", "value": "dea0983839e50f6472208b0b30df61be97df5a3e5da7ebdec0f665c5b6c498ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129070, "uuid": "97cc6be5-dbfc-4ba5-88d8-d1f6416d08be", "comment": "Malware payload (Mirai)", "value": "5f07e8fddcb394581661feca85a73efd64170d1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129070, "uuid": "05394e81-e00d-4ba3-8cb7-cfc6a1869eda", "comment": "Malware payload (Mirai)", "value": "82fbdff7bc2e3ddf33614ecf83601d6dd6aa181c898e6be93d46ead411351e706f93a2700af934bd29212d63d81c2ce4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129070, "uuid": "4098b7ec-f4e2-4430-ad34-902f77a9a208", "value": "T106233AD6B800AF3CF98BE7BF80570909F621771151930B2A6BB7FD936C321985D66D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129070, "uuid": "f7d350b7-31e9-4e7b-ab0e-1495c68db786", "value": "768:1DenlJw81CRLBO2bkq6wRLNiKr2GLcux838r8cTWMzyEYcPlCnWi:pelhcBO2bkJylrNLVx838lWMz1Yck5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629129070, "uuid": "ecea5a4a-927b-4670-9547-834eb6bd4102", "value": 49096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629129070, "uuid": "90131116-16db-4947-bc4f-381ccb528a67", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129070, "uuid": "1a8a6c0b-55bc-472a-82b6-51e3f364a2fe", "value": "a1a298447a5a839777ba414979f4581a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caca2381-fea9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629129077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129077, "uuid": "bd6b52a7-7fe3-48fd-89d4-aa8181f284c9", "comment": "Malware payload (Mirai)", "value": "ae7e3e45529357b67ade46e48d492005", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129077, "uuid": "306a3afd-be8f-4b86-a44d-76244fd43f92", "comment": "Malware payload (Mirai)", "value": "df8b561494e0fb87cac32fd641a16ebcd2b48cddca456f1e17fcc66c0e35effd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129077, "uuid": "f5e7970a-3d35-41ad-b0f9-27016b4bedf2", "comment": "Malware payload (Mirai)", "value": "99171772f8ff5ccdc0be7c0ab21825915db13fd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129077, "uuid": "8ca128d7-9275-4077-b683-6c6fd1625ab2", "comment": "Malware payload (Mirai)", "value": "70d20d9317775e37ed5ea5cef4ea3483209c024519bde4b560cf5bb4376093e0ae67f17598644299be10fe6d20ebb730", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129077, "uuid": "7156e837-1751-4a89-8e29-f4c833bcce89", "value": "T190331881B8D18A12C9D423BBFA1E41CD3326A7A8E2DF32079D216F157BD682F0D77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129077, "uuid": "05781621-0f14-4f57-be76-27a00e3f5e64", "value": "768:7yfsJDUlBf5odAiUapEv3TsIbOkdnoJ+cOezgNveC1wbf2NOFpcoLi:ks16N5kUayv3TsIbxdJFet52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629129077, "uuid": "7593ef68-3815-46d1-85fd-65ea032c9a58", "value": 50876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629129077, "uuid": "f645752a-e1ac-4119-9f02-2f0c96fbe384", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129077, "uuid": "57f03bcd-61da-438b-8053-d6c19112fe0f", "value": "ae7e3e45529357b67ade46e48d492005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7675ff6e-feba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629136236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136236, "uuid": "03d9498d-9787-400a-ac17-8e50ffd88b02", "comment": "Malware payload (NanoCore)", "value": "ec9dc86cbda5ad0a0b6c79654e361642", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136236, "uuid": "6bff9005-336d-4f4e-93c8-cf3eca9d4b10", "comment": "Malware payload (NanoCore)", "value": "df8bf20364ce7962c466084b46a93ad6762b2459191b39d0c141d4c9c375e4da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136236, "uuid": "8096ec6a-6a08-4cfe-be92-dd327324ed51", "comment": "Malware payload (NanoCore)", "value": "9363fc43bb1f3534df3afd40812c75028f390cf5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136236, "uuid": "fd8e4f78-da65-41fd-8fe8-a7aaaeafb428", "comment": "Malware payload (NanoCore)", "value": "f600dc033d3cc4a7bf83c59de0f9156eb2712060663576fe3ab4c4ba37b722f48c7761e744fc2701b807b05879cf72d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136236, "uuid": "c4512b07-2d85-4e2a-b219-728a3461cee2", "value": "T1DA45FA3915B82727E0B9D725E6F14447F3E0985FB261ED59BCDA43AB0206E4266C333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136236, "uuid": "30c44db2-88ae-4224-b007-1d52e92ea8e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136236, "uuid": "5c5ad96d-9a75-4020-976a-a171aaa99582", "value": "12288:WGiW1r7KOT49jaOcsFYJDc9F3nC0Py3gAh7IalhBXRp5DH//rLD5FgRX8A/f0YGs:pYOT4FcsFY3blhBXdPDDgyclh1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629136236, "uuid": "61381fc7-60f0-46d6-8a67-e7503f82452f", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629136236, "uuid": "0a09fb6a-7214-43e3-9473-2e342379ec6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136236, "uuid": "b4fe2fb0-942e-41d8-9bf2-df88be6591c2", "value": "ec9dc86cbda5ad0a0b6c79654e361642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9616201-feb9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629135946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135946, "uuid": "ee4cbb3c-bedd-4373-9165-8b0431d278f4", "comment": "Malware payload (Formbook)", "value": "5ee375628c34cd0aa0833e24bc31087a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135946, "uuid": "ff6799d0-2449-4f79-bdee-affdf7742ae4", "comment": "Malware payload (Formbook)", "value": "dfe96798a6065c99050d1cb964200874b40e3916f90e3caed35df9ace3dc3198", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135946, "uuid": "454c94a7-954f-411b-928c-608a9800c1d7", "comment": "Malware payload (Formbook)", "value": "1d8c406871a1969850fd31883f23b56cb0bf0380", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135946, "uuid": "274a23f3-f5c8-4092-984c-785031b9137c", "comment": "Malware payload (Formbook)", "value": "5037fda786d349bc5e78b9754f7cb07f225f291f9b0285f28944c7749440b93b6f65d36f2943f747ef11dc26f87edd8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135946, "uuid": "083d8c81-5854-4e6d-9e78-b03df9958acc", "value": "T1D545E73915B82B27E079E369E6E44417B3E0A45FB225ED59BCDA03E70206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135946, "uuid": "7d892805-2cd1-49a7-afdb-3f2c396e2171", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135946, "uuid": "cbd7ca87-932b-4020-a4c4-6eb9a78debf8", "value": "24576:0NHIFYVblhB4Y2K4DzXmg87g17/QonXK74sufqV:1yF14DPOUwcsKqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629135946, "uuid": "aa8db3f0-49af-4182-a412-80b5fe73ecf1", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629135946, "uuid": "bb18c28f-146c-4c1e-8fad-da94ec30f8dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135946, "uuid": "a62fb967-61c3-440e-8c27-8078d756e5ab", "value": "5ee375628c34cd0aa0833e24bc31087a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db79e099-feba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629136406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136406, "uuid": "11c3d426-3f71-4a15-b019-1420739ac320", "comment": "Malware payload (RaccoonStealer)", "value": "6435e2d836343e39c2f27c474a1065de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136406, "uuid": "6902a569-c55c-48ac-a8ce-1d888b487a98", "comment": "Malware payload (RaccoonStealer)", "value": "e007bd0e0d0d1a6374a423338bc23a72483932b0e47a3eec3d4ace18f9f09173", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136406, "uuid": "8a174486-1620-49ee-a0b6-0917a4031e06", "comment": "Malware payload (RaccoonStealer)", "value": "393c47f5fad13e52ea45c72392aa5b237cd8b75d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629136406, "uuid": "aa3ee029-cdeb-448d-a3db-d576e631dd53", "comment": "Malware payload (RaccoonStealer)", "value": "cffc9fd962051fdac75ddccd807262c17347cca713a021960ddf17195d17f1e90afafc6ac13468bb946893854c9f4cd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136406, "uuid": "4395240c-4ff3-41d0-8e75-8e2621875d4c", "value": "T19414D0127590D032C092077264A2FAD09A69BD32E6F1166B7B993D9F5F303D1933B78B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136406, "uuid": "258847a6-0c70-4d41-be4c-048ff7416cc6", "value": "e13582e50ecb7af95558f57b919f6a34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136406, "uuid": "0db1671d-6aa1-480f-9fd0-f21064f91934", "value": "3072:y2FeoN9fjjPBwhTcKy5BNM4RZQuKT0yB3eXln8SKDUs:FjjPYTcKyClWX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629136406, "uuid": "50051582-a8c4-4340-9ae3-0eefca3fa096", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629136406, "uuid": "55afb74e-5abc-4c2e-8951-44a3ce857afe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629136406, "uuid": "a4ef7040-64d7-4979-85bd-059f4f336fbc", "value": "6435e2d836343e39c2f27c474a1065de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdb8c7f-feea-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629156675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156675, "uuid": "b81cb1b8-b2be-4a4b-a448-8b09242b0010", "comment": "Malware payload (Dridex)", "value": "c4eb5f0e2122795a05d0bb4bb84e42bf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156675, "uuid": "12b9040f-8d56-44e3-a2a3-893103a60092", "comment": "Malware payload (Dridex)", "value": "e0f0a1b5feb22d8e2010d7adb0639b5e959a75005cf90dae3631e1484d2a09ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156675, "uuid": "e7aa61ac-6c46-407f-a300-8dd4fabad309", "comment": "Malware payload (Dridex)", "value": "9e5b043a056a7b20e03b463a341d2c1148b83e51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629156675, "uuid": "50aabc1b-442d-4f5d-be91-d8c8a12a243c", "comment": "Malware payload (Dridex)", "value": "03b0b1197d74b0b61e6ae336ca30f7406832e1af0a89251454e33c5e052eb4499cb3a441dd70705cf6dc7c23cfa88dd9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156675, "uuid": "fb19d600-159b-439b-8a6a-6c66b7788b73", "value": "T1064402984953E42CFE5F2E3CCCEB10B86F9DCDAE1490A62F11B1B24CDAD07D61D62466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156675, "uuid": "9aeae0e0-82dd-434b-9609-a4c66f463d95", "value": "6144:STtZbAPPimNA/kjoitkEvy+N/mEsFGx02tCIiEKH7:otZbAPDNAcM0qMe/gtCIiEKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629156675, "uuid": "fcfc09bc-4cd8-407d-b569-43d790b386de", "value": 268208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629156675, "uuid": "25cffbc8-3c8f-4f10-a4e1-437bd70e8a67", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629156675, "uuid": "d978face-f76d-403c-9ceb-20cbc7f39260", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_8_405524.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01223e05-fe67-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629100391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629100391, "uuid": "56f0391a-45ad-4a59-abe1-ab37152e3b93", "comment": "Malware payload", "value": "d01426e18080d692f7c2f8fcb5149066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629100391, "uuid": "54c88a3e-ca30-4164-a77a-44e729acb79f", "comment": "Malware payload", "value": "e1107b3e4884e3c447dec10aea41ce9f9e8769bd4b2a36e83545070ea6f689b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629100391, "uuid": "fe85c491-917d-403c-b3cc-8de1e40bc04d", "comment": "Malware payload", "value": "b5790b71919d383489c7231f2d08672108708914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629100391, "uuid": "e1f7a34f-a19d-4347-8ee3-13df8eb450af", "comment": "Malware payload", "value": "000841d2d83280a6d3409e4c5c5a416ca8dadac5927e562b69c40f2083b6b9501beff68a71781e0c5aca3c7a75eed1df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629100391, "uuid": "2ea1645f-62cf-46dd-99bd-5cf786763fc2", "value": "T1E6955B12BCE564FAC5BAE2314AA192A13732BC6943313BCB1E45767E1E75BD02E3D350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629100391, "uuid": "40e8683f-6474-4495-a44a-2f5e51e04b1e", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629100391, "uuid": "22d0c95a-ab66-413f-ac4c-1d71eedf43a7", "value": "24576:LXLMioKUr3Ye8FpskRmHsK1COOo+kLbr9ZwhDbx:LdoKU358XXSsK1pX9ZwhDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629100391, "uuid": "e9556a7b-78e3-4408-bf86-75dbff4f8a56", "value": 1964544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629100391, "uuid": "98165701-3e10-413f-85d0-ace3bbdea527", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629100391, "uuid": "9b0036d0-6069-4ae7-8b1f-cbd8147fe27c", "value": "Anti2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b337308-feb7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629134849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134849, "uuid": "e56d9e4a-5ff1-40de-8290-62ebe4b7de12", "comment": "Malware payload (Formbook)", "value": "05c2f58892baa673e6dce1721b2ba4c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134849, "uuid": "e0c82a18-336c-4527-8395-9a086b72eabf", "comment": "Malware payload (Formbook)", "value": "e188030a6e62811cb9b70788732d04e339e1396c2d546362fa2b47ac572c9fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134849, "uuid": "d002889a-46a4-4ea8-875a-7ce99aa73b0d", "comment": "Malware payload (Formbook)", "value": "6dc750666d98c463229074c3e52ca2a65fc6ab4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134849, "uuid": "5de3f0eb-0a20-43aa-b56a-46802b775e84", "comment": "Malware payload (Formbook)", "value": "6d333c000ae418aebcdf89a8acace2b605c941532829385e37d6847585283a3491ff5b76a71751e2325226ef9fd7ec06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134849, "uuid": "d97a6d64-8e65-480f-b7d0-9e2d198a2233", "value": "T119E46CBD3150B99FD137CD36C4580E55F660A8A3A2CBC623E0532959983D7AA9E403BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134849, "uuid": "f14d365b-b562-41fa-8cf2-84dc8574b91a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134849, "uuid": "e5b815c6-1b5b-458d-bf80-6ea4fe445aa5", "value": "12288:Ii3XY/Lu5XtnzM2Z9PINmx/2X3JQIOOwYMxz12YnoI5r2BEnyOW91DnLqZeYCtSo:IPzu5dnF9Pymg5NMxNoI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134849, "uuid": "b991dc27-9b6c-48ab-a842-a061d51d2603", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134849, "uuid": "7cdc912b-dc5c-4a51-af39-4e4a9115178b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134849, "uuid": "9fb9ddb8-1909-4350-9ce0-afff6ef3049d", "value": "#91790012. pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c84f021-fee0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629152460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152460, "uuid": "d4d1fc8a-627d-4036-866f-f367cd5aa03b", "comment": "Malware payload (Dridex)", "value": "e21a699db23d88e6ff25437af8c8330d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152460, "uuid": "a87b77ca-a022-4b8e-8ac7-15cc2e9e55df", "comment": "Malware payload (Dridex)", "value": "e275b940b72bf231fd3da90f4461375f4de74141bdf758ee8be1d1178ed38862", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152460, "uuid": "c651f0b9-730e-49f6-b759-47960d56cbaa", "comment": "Malware payload (Dridex)", "value": "8191c614dd2b0147e28546c9d40655d686494801", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629152460, "uuid": "69ccd423-d9c5-43bb-a1d6-f54af1507c7b", "comment": "Malware payload (Dridex)", "value": "b8b4f48aa0d9b533105b45c71b04f33b03c53e2af6508e5908b83fbac0222767ea446e53e362d17949916e51b7644567", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629152460, "uuid": "9e014f97-6d34-4510-9e81-300553f92cf9", "value": "T19E4402551A5BE59DFE4FAC7CCCCE24B0AF99DCAE0240292F61F0A11CE7E53D06C69096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629152460, "uuid": "bcd15df5-d8f6-4eea-a3ac-f2a19ad48581", "value": "6144:SxtZbAPPimNA/kjoitk/KoUP2y4KX3Mh5obUfJMg8g:AtZbAPDNAcMPFy4KXc7IUfJM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629152460, "uuid": "d04cf7e4-a52e-4d0a-89b5-411c5cf2eb3c", "value": 260718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629152460, "uuid": "a33ab4af-f7b3-4738-9199-92ca9bffc464", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629152460, "uuid": "23de6f3a-65cd-48ad-95e6-576dacf79311", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_3_0003737929.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb79564-fea7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629128117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128117, "uuid": "8045ca39-43ce-405a-b3a7-ae5b6c7ae9f6", "comment": "Malware payload (Dridex)", "value": "d43818b628ef3187b9143328cb60a38c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128117, "uuid": "c4111b98-1f37-46e7-bbc6-5054ff438ed0", "comment": "Malware payload (Dridex)", "value": "e4110fcf4cc295cbb190823ba1a3b03c600ff7ed9bb25709aeadb3e9a53c054d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128117, "uuid": "a87db785-e558-40e8-99e7-d8bc3442c6a6", "comment": "Malware payload (Dridex)", "value": "11cedfe50a92c796a08dc793e8e4c2133ba8104a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629128117, "uuid": "8d3658ac-692d-415f-84bf-1f96dd4913ae", "comment": "Malware payload (Dridex)", "value": "d1878767bff3a674e1bb4ff5bb83eceec46e4adcdf83a005fa6337b4b683a3a9f75b66ef106ff4e88741f52f034ff605", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128117, "uuid": "83b18f52-3c58-4a3d-848e-c06081a5adaa", "value": "T14164F18A3567E4ADFE4EBC7D9CDE21746BD9CCEE01102A7F61F0262CF2C02964D25592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128117, "uuid": "cffa2058-8233-4bb6-abf6-3c966dec5a00", "value": "6144:SAtZbAPPimNA/kjoitkMNm+rJXfmrU9kbYdyE9fbAfqJL00MvIc3o6hNmpHz:xtZbAPDNAcM8Nju2kbKbAfMLp9c3o6hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629128117, "uuid": "d742d5dc-269a-4225-b696-f0178bdb45b2", "value": 324083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629128117, "uuid": "a34be57c-abc6-442f-985e-7433176a4fe7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629128117, "uuid": "d897c1aa-90a2-40ae-9a61-6acab0ed1931", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_385649711.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a027b7-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629114217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114217, "uuid": "ecc82dc8-0e7e-4303-ac9e-14d2a4d73695", "comment": "Malware payload (Smoke Loader)", "value": "336d42b9644d1e90e0c61c1af09e0832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114217, "uuid": "d9c0be2d-5829-471c-ba19-ce612923667f", "comment": "Malware payload (Smoke Loader)", "value": "e545972e3e71fb03424e4a4e00144be6d67b1c92ca8c34608725cf10ffe944bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114217, "uuid": "cab85b24-1faa-4009-ac16-0fb4f2ec92b5", "comment": "Malware payload (Smoke Loader)", "value": "ff2d1e486bbb5435af8d3debeb3d2de63df6b100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114217, "uuid": "abaabd8b-74fd-44a8-8d89-934ac9a0e79d", "comment": "Malware payload (Smoke Loader)", "value": "dcf77c191849a2cb84fd0932e05cc28a89eb1b74b488b895dd02a06490ca893ce335b10d144b8c0ab83214019ea71af4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114217, "uuid": "7928357b-f25d-415e-85df-ee8448440b38", "value": "T13B04BE2D748FC472C38579354437CBBC5B79AF20DA63097B27A8662B1EB0EF04626349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114217, "uuid": "da887302-269c-4296-9b69-88fab41a818b", "value": "675f985c31bb43cb925f7664d8fe06b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114217, "uuid": "5a203f28-200d-4818-99b8-9c42763c3925", "value": "3072:OJL5nGOSbnz5bFzON1ATz670SBNguRJc/m0kQZ7yq:OJL/ez5bFzcATze0GTc/m0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114217, "uuid": "336e6f86-1c4d-4e22-9dd9-3d1af8e251cc", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114217, "uuid": "1c4a9c52-2080-41d4-9ea0-b94a5709867f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114217, "uuid": "f2f8a77c-eec7-45e5-82c5-e06107502c78", "value": "336d42b9644d1e90e0c61c1af09e0832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb263c9-fec6-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629141270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141270, "uuid": "73273b38-5350-4bfa-b968-20e3aec3df97", "comment": "Malware payload", "value": "8da1f77ae8e86def7f660eed23b86f49", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141270, "uuid": "56e53b1c-42b7-4f4c-b7a4-969f069a18f6", "comment": "Malware payload", "value": "e55d29099df9d2d4a41c5079c0379c1f6dbde407effdb376e89777d6f2b88180", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141270, "uuid": "b6144ec0-2f8e-4b2b-8c7d-ccdc9769947f", "comment": "Malware payload", "value": "1a5b11011899701d4278ed7447ddb42c19aae310", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141270, "uuid": "c7c8cece-ef95-4acd-afdd-e4c039468f22", "comment": "Malware payload", "value": "29c35be132d7ca3eada0c4ae69707f9c891869651a3ba9aed29258161ce48b8f6e4c25d1bfbfec8f0bfa674949c8476c", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141270, "uuid": "3f1d9fff-ba47-47ed-b5d5-3661435ae266", "value": "T1C2C6336209661F90DD5A437985DB0F836645BB0F841AA31E1B29E76F3FBB3F4C82D904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141270, "uuid": "24de22ba-927b-4d0b-9b53-31849cde2512", "value": "196608:1r8V5PseBEWHqicrf71abiLROpLcVTpXT6MPTBq4zqLK6Gy7/7vU5BaNl24+kd25:NSs27KimfBaUORcVTpD/BfMK6TLY6NVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629141270, "uuid": "ee410fb8-ffbd-4204-8ced-30b6fef7af1e", "value": 12018345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629141270, "uuid": "bf282af8-11f8-4bf0-a888-0f01ec351fa8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141270, "uuid": "4b426564-3c49-42c5-a430-b1f5cc3c52bc", "value": "pm13.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afec8f8-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629125963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125963, "uuid": "df42eaa1-db30-47b1-a9f0-32f0fc442e1e", "comment": "Malware payload (Formbook)", "value": "801fd8e924bfdbe410c5f3e683f8db1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125963, "uuid": "3a8d3bd1-2d79-4010-b8ab-f0a8548a45a4", "comment": "Malware payload (Formbook)", "value": "e5c5e9cbcf29b4639f8ac04a348b9b44bd0ae859558c02c4402ed1d61a4d67f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125963, "uuid": "57a9bed9-3bc9-4ce2-a3a5-a2a15bb0a55f", "comment": "Malware payload (Formbook)", "value": "5b51712278989adf676b38f0a30a901c970180b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125963, "uuid": "4a2714c5-bd80-40ff-803a-bd3820ee2dfd", "comment": "Malware payload (Formbook)", "value": "fe704cae0fc561d2107c8a503749d13d83c17d9b38be8110074d49c8285b8f7cf438a847c57f582340d8b9e06aa309c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125963, "uuid": "1519d465-5372-4f02-96f8-d3f704bd8687", "value": "T14BA4D05173C261BEECB258368455C2B78B36FEF6127748CB13ED247B8B611C11E2A963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125963, "uuid": "1fa95d80-decf-4a9a-a175-d3d39f46259c", "value": "3843c741cdc52e7d421ce37832f6b109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125963, "uuid": "9815adef-58a4-437c-9ced-416d2eb27ff5", "value": "6144:T12d/D9X78MZ57ddTZkEOV1p608Zu3oRIR4b2a2GRU8b8RVoM3Hxb:T12dr9X78MZ57vZ/OVTv3LR22aI8IxHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125963, "uuid": "3aa9d084-c1a1-4f2e-95ea-3b48ce8a29dc", "value": 468454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125963, "uuid": "d0e76740-e581-4413-b772-f95c8bb9d843", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125963, "uuid": "83bb8034-760d-444b-9854-fc9f8a69516d", "value": "Payment009483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b896c506-febf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629138495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138495, "uuid": "efd317cc-bead-4732-9f79-ce266a26aba0", "comment": "Malware payload (Dridex)", "value": "ba83d8ddf6b3b43cf57d65785e80edf2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138495, "uuid": "7398c7ce-5a93-4bdb-b077-97d28ed35f84", "comment": "Malware payload (Dridex)", "value": "e6158b44cd4160d5f73603802c11fcfe5b1e233ae56dc902e808aecdff08b0cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138495, "uuid": "8ded1cdd-d200-4c0f-ad6d-ab559ffbc2f3", "comment": "Malware payload (Dridex)", "value": "f992c59425d91438ffdfc7c5a2bf91956e3d0908", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629138495, "uuid": "b1485a59-5381-427b-9b9b-69d35b664026", "comment": "Malware payload (Dridex)", "value": "35cbd1196c5c06027ba887c0c998179047a65442f2f324ac28cf1d9a7584a45d8fb674aa20a3910ad1fe153b882c8b42", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138495, "uuid": "b72d580d-91e1-4d6a-a299-454c3f8cbeff", "value": "T18444026E42B3E120EA9B60B89C9B1FDB27601E3F25C02356F9D2E15D6D25DE342D418F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138495, "uuid": "12dfb224-1aaf-4bec-927d-20b0ea32dba5", "value": "6144:SKNSLcq+YXEsaDX7k8qqqTHcS32F3oFNbv3RWZKjR:BPYXEsuLcl2dQNb0KjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629138495, "uuid": "d6fd2419-0d77-40c3-bb94-23d9908c31c8", "value": 272709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629138495, "uuid": "1549415b-0dfa-414e-b8e5-578beffeddbf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629138495, "uuid": "02d1b068-c03b-4db0-a976-fa6eda0a86bc", "value": "_taxve_10131_20210816_6711104868_48688352.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091e54a5-fe5a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629094821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629094821, "uuid": "531ec3c9-a2bd-48f3-8232-e24b7ff83648", "comment": "Malware payload (Mirai)", "value": "08a82dda567c4db68cd0bb711ffc36f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629094821, "uuid": "0e9f8abd-c498-40ae-bd55-a83d10a9ece0", "comment": "Malware payload (Mirai)", "value": "e653acd236773d44c8cdb8ba609719edcf4e36873905a1c8be4d41a877141b2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629094821, "uuid": "b72e3255-c90c-4cf4-b518-3e3ed12f530f", "comment": "Malware payload (Mirai)", "value": "6ad2810a73f5f200bfc7200a29aecd72c2b9eba5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629094821, "uuid": "b48cf3ac-c64c-460a-9507-55d65661aa91", "comment": "Malware payload (Mirai)", "value": "e7ff3c803188863de2feeb58c2306ce0c10d79f7f3dd53a50a7c7ce6a013f9ba1bc02347aa2a79a0e20ff9a2448101e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629094821, "uuid": "5ebb43ae-8610-420f-8d2e-5748fbd8e5bd", "value": "T12B64F2DAED01AE75F9C54779BA1F074973B28BE8D3C3B110E624C6143AEE2468B355C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629094821, "uuid": "b968f949-51b3-4b9a-8b39-a4f127ee39f1", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncXoNsKqqfPqOJ:78QpZsKCaiXHKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629094821, "uuid": "af46da61-4ec2-440d-9096-d227ddc99997", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629094821, "uuid": "4d3f9019-b28a-4261-9b3c-db2cbaeaf9c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629094821, "uuid": "d31e8c4a-7de9-439a-8463-ceb961104082", "value": "08a82dda567c4db68cd0bb711ffc36f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2d69ce-feb5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629134099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134099, "uuid": "bf1797c8-4b34-45c0-bd0f-bda7f7d089b6", "comment": "Malware payload (Smoke Loader)", "value": "a19f250d646bde9b47deec9023fd27f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134099, "uuid": "4b11337e-ab23-4a78-801e-bd596c74e5fb", "comment": "Malware payload (Smoke Loader)", "value": "e74bc1681d06f6f4ab4f3eafaa576329266891516a23b6e8b96410f1b8578b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134099, "uuid": "dc2af7a5-606d-40e6-9afc-cec37875bb26", "comment": "Malware payload (Smoke Loader)", "value": "4daab7f5422fbcf14689aedfa353af3e1d07e64c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134099, "uuid": "1a5e7ee4-38e2-4b95-aa32-c047c5072b41", "comment": "Malware payload (Smoke Loader)", "value": "6da5543bf32e08dbb83291b17fb052b2ca4dcd3fa0a36949ff9f5a3c37370c16d71908cd1233376afc7fc1e024738b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134099, "uuid": "685b190b-7cec-4aaf-83a2-96ed509b69cd", "value": "T10514CF21B590D573C0960130CCA2FAE15B69BD70EA7E065FF798399F6F302B0566B34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134099, "uuid": "21268184-c203-4b1e-a197-5e831a876bdc", "value": "32eca4427f106c548c06ec4f87d7efd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134099, "uuid": "41ef3d35-8788-427a-abd0-eebba0fbbcce", "value": "3072:unOp9Oy5MmoJn+6ldzV8Dpw9BN8H2RzQuKT0yB3TG3gbnk/Qvq:u+5MZn+2dzVHDilq3g4/Qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134099, "uuid": "f5bdb7ec-c4df-4a85-83b7-9202eb6759e7", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134099, "uuid": "2d6c97b6-e278-4113-9297-9c225e32b548", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134099, "uuid": "0d39fbe7-1c81-4516-8339-fedb748b85a3", "value": "a19f250d646bde9b47deec9023fd27f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa631d04-feaf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629131733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629131733, "uuid": "c9b1781d-f3a0-43e8-8d2d-f94dd78b90a4", "comment": "Malware payload (Dridex)", "value": "50d8c7f7b796247dd9adbf7e06593250", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629131733, "uuid": "afbaf75d-603b-46b0-b0b1-aa806cd036a7", "comment": "Malware payload (Dridex)", "value": "e8fdd8f2f55e2688f340f554b931fd52f180101c19378e8efa3d609315f8cdc7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629131733, "uuid": "a34f0aa6-0849-441b-8782-bba9f5a936d2", "comment": "Malware payload (Dridex)", "value": "41a5dbae71ac84a2cdda848bb6ec7478669b88b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629131733, "uuid": "009da7ab-a677-4d9f-b7ab-3a512afce866", "comment": "Malware payload (Dridex)", "value": "dfc910934d37db988853b164f72a407b4277e4a327bac804494bda87d9b0b024186d921dfe328075c66d98dfff73275f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629131733, "uuid": "1c4540de-99d2-4359-a78f-cc94c069a1f1", "value": "T17E34F156AA43E51CFE9F3C3C4CEE18B82F99CD7D09406A7F11B1A61CFAE07852C1519A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629131733, "uuid": "945aaf51-bfc7-4abe-8d11-56d365dfa3f9", "value": "6144:S6tZbAPPimNA/kjoitklEl1UuFheXuF2yjlPefogU3W48Si:9tZbAPDNAcMVYTFheWNjlGuD8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629131733, "uuid": "40801eaf-6d9f-46f4-aa3b-9c8c76692d2a", "value": 248219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629131733, "uuid": "69f5353a-e50d-473a-92c4-773c9be7783f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629131733, "uuid": "82adb28c-c690-471f-a1f2-830d5c7eee69", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_5_4229357543.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44af819-fe58-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629094357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629094357, "uuid": "bdc7bec5-2dde-4b48-beab-172dbb1b4008", "comment": "Malware payload", "value": "dd495a701de02937720c4a72ec1f1b91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629094357, "uuid": "d4e0de1f-3b7b-4610-a389-5f7df0dc1aac", "comment": "Malware payload", "value": "e980bacfa4c34981f72b5e53e761a556a8e3e94a3ace3ebaa5b796aea2b67576", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629094357, "uuid": "5ce8671f-7c55-40bc-9594-896008f01a12", "comment": "Malware payload", "value": "3174e14bc0b6df0597107b93eebebb49991305ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629094357, "uuid": "62994c72-c588-4b92-b6d6-306e317c81af", "comment": "Malware payload", "value": "988799004bd93c921a8518144fe179eb671c3497bdd8440b26edbf042d8fd7385d04e534da5ae4862c78f312ab746bca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629094357, "uuid": "5031e7e9-a628-4d6c-8a5e-0726b551ee15", "value": "T1D554E02C755FA472C39539305433CBAC5AF9AF40E69301BB1B5C3A5E6F38EB0526634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629094357, "uuid": "a15b543f-3388-4827-a457-8db633c64e58", "value": "894d0e2453b674d7fa4cc3ff89ddc063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629094357, "uuid": "73e943de-8428-4bc9-93ab-876c865001d5", "value": "6144:GKrLgPtvEe0ckd5pgblD02Pjy9//FUClNA8kqzWYc/mM8:GqkPt8e55N02Pj+/FUClNA8Ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629094357, "uuid": "27e9be17-f258-45f0-96fa-d95398d015b6", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629094357, "uuid": "f2f64d17-c98f-48d6-a09b-5896cb28cca0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629094357, "uuid": "b69b5631-ad53-4d4b-a10d-cd57832c2bf0", "value": "dd495a701de02937720c4a72ec1f1b91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b845ec-fe70-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629104486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104486, "uuid": "ad367626-e834-40db-9aed-7bbbb9c090a0", "comment": "Malware payload (Smoke Loader)", "value": "d86d71d53b351a9d3c585b7e8b24d525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104486, "uuid": "207ccaa1-bd0f-48a5-b145-bb1d0e4cf3ae", "comment": "Malware payload (Smoke Loader)", "value": "eaa52f460d64093ebcf267e2fa4ebe342b31ee442127afe065892b790409eb33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104486, "uuid": "bea6279a-809d-4208-a382-d3fee0e773ba", "comment": "Malware payload (Smoke Loader)", "value": "590a404f7a297f97a8bf78f072a152c7ebdea277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104486, "uuid": "f2e891bc-b244-4aba-9c2d-268745236a23", "comment": "Malware payload (Smoke Loader)", "value": "7eb16e337ebfd41f9cf9c9a39611e7f92b301220c3e8dbaaca83e0f5dee2b1b24e5aebe7a27a886530a3c4965d6c6cc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104486, "uuid": "affbceb2-082c-4088-b1db-dc614425128c", "value": "T1F904BE2D799FC072E355F13044B3CBAE0A78DF21DA57047B6798296E1F30EB1966234A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104486, "uuid": "1c5bfaa8-e8bf-4e9d-b6d2-a9b66fdf90ab", "value": "675f985c31bb43cb925f7664d8fe06b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104486, "uuid": "913d0667-4d14-46cc-840f-9245f3a9ce0d", "value": "3072:5W0LJHWDX7nj2ABMbZ1PTW6+yBNg/Ryc/m+3tQM3wVZ7yq:5Lirj2FbfPTW6+m3c/mXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104486, "uuid": "7a4333e8-6b2a-4c43-8d2e-aaba5a1451b3", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104486, "uuid": "db538d14-6b52-4960-a04e-565f4ac50640", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104486, "uuid": "09a5f388-c128-4811-818e-fe6620ee3240", "value": "d86d71d53b351a9d3c585b7e8b24d525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b93ef3-fe77-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629107303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107303, "uuid": "88c0b2d2-b1a5-4467-a8e6-305cf8dd37d2", "comment": "Malware payload (Loki)", "value": "61521d238c7c60ca7e91881ffda4a5fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107303, "uuid": "c9b41e39-0b10-4641-8833-bbf903c15da1", "comment": "Malware payload (Loki)", "value": "ebdee756cd475a65df67185291c3fffad83b91d8c59f8248160f6b0ff15fb279", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107303, "uuid": "8eb8b44e-e62e-43e6-93b2-267faeb0a25a", "comment": "Malware payload (Loki)", "value": "5e52ee81e3de4bf3b292a320e1d8aae0d72227f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629107303, "uuid": "a4f2c98f-854a-4d40-86f2-48571d891f4b", "comment": "Malware payload (Loki)", "value": "f64554ec1a2d26f28a773e056ee72cdea4027a840de020ba43c8efa1674642a929a5b96d24b2d0dd26c03b914f8ec99b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107303, "uuid": "1407d404-080b-4f5e-b080-d6d972ed8e89", "value": "T1CEC4CF10B9C0C032D673383147B5E6B11C6DA9302B259ADF63D81A769F64AD1EE3672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107303, "uuid": "ed51455f-0e7e-46f2-ace9-5c6b5933fdbf", "value": "82004e82653b7bafbfcf73a18d8cef95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107303, "uuid": "1e3124db-98ac-4a6b-8f50-5a8c8dcf5b26", "value": "12288:tmKF7mX3Ulh3pP+BcepL1k7tTsRc3EQVwmBuFsCyqMRYZu6mG1dSNWKnmR:tmKRscepJuTsy0QVXO9+NWKnmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629107303, "uuid": "156cb8ba-216b-45f5-8caf-e080967bc3ca", "value": 567413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629107303, "uuid": "b2e45855-f128-4e62-be15-c228b4b1bcb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629107303, "uuid": "570f192b-2f4a-4622-a486-bb50b5f439c9", "value": "61521d238c7c60ca7e91881ffda4a5fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9423252b-fecd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629144447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144447, "uuid": "b108578d-4615-4848-9dbc-b33e2c8dbcce", "comment": "Malware payload (RedLineStealer)", "value": "959b240bcdd66141ec90d71519f8dddc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144447, "uuid": "9860d69a-88e7-4031-b63f-40e5d838753d", "comment": "Malware payload (RedLineStealer)", "value": "ec2d7c2ee1e9efbd894f541b1fdd302be1ed97628a46e0919af03d78bcf5ffdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144447, "uuid": "895286c5-59fd-45be-9278-c967d4240137", "comment": "Malware payload (RedLineStealer)", "value": "d387bbc98605c9a81311f8b4142acb94b20a7274", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629144447, "uuid": "ca9b7131-b382-4f10-913e-7a907da36ba0", "comment": "Malware payload (RedLineStealer)", "value": "a5669ab0ceaaef256d0f28e1dafcb0b2c87c12d8150f33d523adfa2c56beed894a7c0c281192910cfa3285d6c892a06b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144447, "uuid": "74e74d2d-93d0-4d47-b799-649b0186a945", "value": "T111D4FE14567FC016D4E7EAB12DDCA8BBD9A990E3640D793710B4633B8B52784EE0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144447, "uuid": "9511c210-701b-4243-ad9f-f87a8707c0fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144447, "uuid": "67681fad-67e0-4abd-bee2-80abbc21e67d", "value": "12288:4kthKhVkP5eA1GomW6kZ5mM8fpCuKVUbO/4W8:JQ0132M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629144447, "uuid": "df782509-c670-4967-b2b6-d8e4f8b3be84", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629144447, "uuid": "1e7b831b-1174-4663-8b84-5d27889a530e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629144447, "uuid": "8ebb570d-550a-44ce-a47c-957e51ee3a3a", "value": "959b240bcdd66141ec90d71519f8dddc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f587bd61-fe86-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629114116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114116, "uuid": "a8bd8c91-d33f-436f-8341-bb6bf03ed1b9", "comment": "Malware payload (DanaBot)", "value": "62533abfa160caa12b9965e649d90ce5", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114116, "uuid": "9877d2d1-3cb8-442b-a0e7-97e93a94fcd3", "comment": "Malware payload (DanaBot)", "value": "ec655b1ee274490143454b9d1d2cf42d4629bd17cdd6f64787b2568e1a444489", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114116, "uuid": "2e7ff0e0-8955-4e5b-9093-027b626b6849", "comment": "Malware payload (DanaBot)", "value": "feead5c4db40dff36a62abc734fab5b61ff62cef", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114116, "uuid": "daaf98b2-1fe0-4c99-a5b7-e89b3894071e", "comment": "Malware payload (DanaBot)", "value": "798e37d6f62d2fba4c5631f272ee484e45438a8fbad0b12315c98b4ad4d5ae85301f7966b9114c078d8f1e8422fba643", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114116, "uuid": "b8e27b91-23cb-4e57-8845-d196c72ca213", "value": "T11335236D111F9175C30133B04177DB5C99A66B20EA2354BF57A927AE8C30FF01AE6BB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114116, "uuid": "a0b89d92-ea4f-4dd6-a8fa-ac5320ad902e", "value": "675f985c31bb43cb925f7664d8fe06b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114116, "uuid": "42098a90-5efb-49e4-9f35-b1ce2749f0cc", "value": "24576:ZOHAxlvO5FAJXrpO9zVQmw9ytO9ga478hsl1VnCBVEhyp:EAxBOXAJXrpOjQV9AP8cAcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114116, "uuid": "a2be21c6-9897-466a-90ca-cf041f11e90b", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114116, "uuid": "dcca0720-a791-4900-937d-89d2c44286c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114116, "uuid": "1c63deb0-bab4-4e52-a6ba-e63603bd1836", "value": "62533abfa160caa12b9965e649d90ce5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b476f8-fe86-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ZLoader)", "timestamp": 1629114067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114067, "uuid": "25ccfed7-b402-41cc-9c23-2e8614bc725c", "comment": "Malware payload (ZLoader)", "value": "8f87fe90d589a4fa73cff6a242fe222b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114067, "uuid": "625cf54a-8d93-4aca-90cd-5409533d2f58", "comment": "Malware payload (ZLoader)", "value": "edaabcb2e82b51c9b8df54dc82afc494bff804b1b187c4657ab583e8ca0bd052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114067, "uuid": "872655cc-3395-434c-9d44-f86de1dce575", "comment": "Malware payload (ZLoader)", "value": "381e33872d0f6f1a7233beeb6e9524435c2a9ab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114067, "uuid": "8333af54-990e-428b-94cd-b386f4bf8aac", "comment": "Malware payload (ZLoader)", "value": "b4677b31d0b0bbddc55188769cd214bee7179c4c8f9c0ab4b66ea4fa22ad90a8468c14a7e5a9ccd94666bb6c756528b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114067, "uuid": "e89cd2bf-c60c-4a6b-8e82-9c0097611240", "value": "T1E8F37C0B63F820A6E4B5937059F202D359327D615B3982FF128E997E1E336E0B631B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114067, "uuid": "3fa37667-102a-4b0f-8b14-b29e92302e7e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114067, "uuid": "4d0cdb7e-6291-4706-975a-d11950d26b7e", "value": "3072:/ahKyd2n31D5GWp1icKAArDZz4N9GhbkrNEkbUP3rO:/ahOXp0yN90QEha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114067, "uuid": "f817d877-04b1-4740-a66f-8f142fce5e03", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114067, "uuid": "54951c07-ec7b-4ad4-94fb-be158b810bab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114067, "uuid": "cbfc70e1-4509-4df9-907a-9bec3d655127", "value": "8f87fe90d589a4fa73cff6a242fe222b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82a2576-fea1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629125609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125609, "uuid": "eb6e8779-3069-4335-a149-42e6ada69125", "comment": "Malware payload (RemcosRAT)", "value": "19150b4addccb8bdfd932e4e284dcfd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125609, "uuid": "fe27456a-7b67-4c18-8ce4-8bea63517dd6", "comment": "Malware payload (RemcosRAT)", "value": "edaf123b4674ac2b77b1b2022f354b152e42ac28949c33f79f67e08bf827645a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125609, "uuid": "98579b9b-eae5-4f2a-a3b5-0d3d59d286f7", "comment": "Malware payload (RemcosRAT)", "value": "86eb79eae5c742475278b929c2ea803398676950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125609, "uuid": "ae79f4fa-bf36-4a63-9a53-af3ca74c74c8", "comment": "Malware payload (RemcosRAT)", "value": "107243cce82bbb4d4b21acd4a1c668c04c43fd6263e8860ef349827e150a8e5db26cefc83425e98d156222e531841b73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125609, "uuid": "85ce97c3-f64a-4b88-bb9f-ee63dfdfc158", "value": "T14BF4E1663780FB8EC17A4E36C5425900EBE0E6775707F3CB6CE258DC1A8EA954A63346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125609, "uuid": "9d40efec-7295-4aef-9f3b-f037d9f2cb5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125609, "uuid": "84d22194-9a19-49c2-963a-ed2c02c0fb85", "value": "12288:Soh/KoW81wuskRuwPn3clQZ+2tf5u1R++k8yz3f1XQmJaMgK8LRuQN/YmPxNU3Pg:SoccwmujWRoRjk8y7f1XVJaMgK8LRugj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125609, "uuid": "dd5119a0-43fb-4165-8870-2ee03720a1df", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125609, "uuid": "d3efcd99-836a-449f-8131-dde2b1a0adbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125609, "uuid": "3650f75b-34b2-4cbc-9166-fee5d90d748b", "value": "CENTRO_H.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af933148-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629104979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104979, "uuid": "d9327c20-ac2d-4960-903d-1b55038d2b55", "comment": "Malware payload (ArkeiStealer)", "value": "22ff4cab9b222f7bcc57ac3c317b02f5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104979, "uuid": "90f56717-8e9a-4b55-974f-ad608a573955", "comment": "Malware payload (ArkeiStealer)", "value": "edf0c8016d4968b1784a0121e2dbaac68445f8a8280a0a590b44e31a15bf3355", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104979, "uuid": "835b05ef-9bc0-4510-af5f-c691cf67d859", "comment": "Malware payload (ArkeiStealer)", "value": "ea845f88acc2ac84ab79fab324e70d6e4d3a2277", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104979, "uuid": "7f904752-afd1-4ac4-844a-c3ebb29ac316", "comment": "Malware payload (ArkeiStealer)", "value": "2ed8eea5154c340803dfa7c297efb4526be10892dcb0b1080b1a6a71fb492b4142e8ed9706959d3ead636f6fc3d76898", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104979, "uuid": "d4816baa-856d-4ed3-9dbd-1548191a6de0", "value": "T168C4121DB18FC1B2C745B2714033CA6D19291F51DB7B153F1B9426AE6F32FB02B262A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104979, "uuid": "a25dc03c-d5ac-4623-aa0d-d7139a4bb44e", "value": "b6eb307a53194f1a2629d22afffc5564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104979, "uuid": "dd4a2ab7-b18e-4566-bc2e-955365ddb5a3", "value": "12288:50ctR6ZNVxmaf+3q6bZOH44o87LQDiWkUlZmSCr:VtRaxQg44Itnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104979, "uuid": "d3305f7a-06bc-473d-ac54-b50e7fbb7e01", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104979, "uuid": "2023f384-0528-4b8a-9847-b4d49e147a0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104979, "uuid": "2b9ce85f-608a-4181-b6f8-191087a0a462", "value": "22ff4cab9b222f7bcc57ac3c317b02f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cd857e-fe8a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629115542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115542, "uuid": "310fdf1c-f7e8-4f0a-a6b3-a12ede883a2e", "comment": "Malware payload (Loki)", "value": "b266df03c57659792d1ed7f5b6e68507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115542, "uuid": "c3774e3d-bcdf-4599-879d-6e81aa63e695", "comment": "Malware payload (Loki)", "value": "ef4dc347901bbc4ed2bf4bc21dc8faa2ce9691af0ba20e659ea4464320f24348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115542, "uuid": "72c4fdb4-48c1-4035-b74e-5a4afadb4c04", "comment": "Malware payload (Loki)", "value": "b3cc97d0cdbac7735cbf05e75105fcc9b1bab26b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115542, "uuid": "ae77cbfa-37e2-4664-9228-e3593243472d", "comment": "Malware payload (Loki)", "value": "7f910d4d668ceee775e646665eb6c6c6239219f35491e324e12bce5f64b78157f6eb57922e89aa3fa8abf10070f34cd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115542, "uuid": "c4813b4a-4a77-4e69-83e4-3e856bf85b87", "value": "T1FAD44A7C3150B5AFD13BCD36C4580E54F660A8A7A3CBC613E0932959993D3AB9E442BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115542, "uuid": "123fcbae-d757-4324-8e75-8c34a0d759d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115542, "uuid": "41f4edc9-d187-4adb-8149-a55fc207c35d", "value": "12288:RhRNEnAmVA1Yy0NTJHOUnn1Iv/gVjniap0BQHLpBlH5ne387utOUsR6:BvmVAl0npnn1Gjcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629115542, "uuid": "bd0ce1da-8b6c-4ddb-8caa-8b843908b423", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629115542, "uuid": "e7d61335-4451-40ac-8e0b-9c38bd5f0dde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115542, "uuid": "2594d32f-4071-4aa7-a92f-19ef8a7280a0", "value": "DHL Consignment Detailspdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04758149-feb6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629134327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134327, "uuid": "5ba5fb07-7f9c-4f4a-97df-cdacfc54fcc6", "comment": "Malware payload (Dridex)", "value": "0b1145386e54c133263fc6e8a9a71ed5", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134327, "uuid": "f04b3c39-2855-4989-81bf-6142ac0ef0a1", "comment": "Malware payload (Dridex)", "value": "f03234e69c590e38fb19c15c19a1b1526da18d6ea8d2634ae9fd81dbf5168b2c", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134327, "uuid": "ca460b24-17e6-4200-b79c-742eff1ad606", "comment": "Malware payload (Dridex)", "value": "425de0627c45d39118b4ab7e15e07fc97df1f31f", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629134327, "uuid": "26dee0ec-9e94-4ed8-89ba-de0b1f1a03e2", "comment": "Malware payload (Dridex)", "value": "89e49fdf7defdf881aad413e304168599daeb3822cdd21497830f8cfcf642423bc26bc6d3dbbf4f4c86b5f9ace1bbdf7", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134327, "uuid": "e4f93170-976c-483b-8e8e-eef4d45edf57", "value": "T10E34011985B3E565E8DB507E4C9E0FDD17B18E2F06D02B42F9E2E64DAD18EE311812C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134327, "uuid": "6a4032c8-cfe2-496f-982b-c0e652112dce", "value": "3072:SjAeN0RKSwCchO7e/1GrpdXx6sj848QjWvpGtdWWDDEAB7VaQFhIcB6tOVRa1J:SDNSLcq+YXEsWpGj53ha7o+0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629134327, "uuid": "e123322f-c4f3-4388-b6c5-e71693adf2ab", "value": 239458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629134327, "uuid": "943503b8-eb84-47e3-ab1b-baf861a4c176", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629134327, "uuid": "6b42652c-f1ae-49ca-8bb8-b6c260c1a82d", "value": "taxve_554964502_20210816_85994972_572710651.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f882f8a1-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629105101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105101, "uuid": "3656ba81-60fc-47b0-a635-dd19582f26e0", "comment": "Malware payload (Smoke Loader)", "value": "2d62eb793b2649d519f14e3a9447089d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105101, "uuid": "3b797b41-05f3-4f04-9347-fa7a7670459a", "comment": "Malware payload (Smoke Loader)", "value": "f0bc49d224a52c749f5f68149765b6a1420598013d1bf7456a6ea46faa476aab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105101, "uuid": "266e22a6-b195-4135-a9f1-b83bfb4415f9", "comment": "Malware payload (Smoke Loader)", "value": "3015db20b32a0bd68af5b08af8badc0dffc454a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105101, "uuid": "c4c5cfb1-1787-4b13-971b-9b90be3d6c2e", "comment": "Malware payload (Smoke Loader)", "value": "0376c891f5fa74e2a7dba286153971eaf14b399c23c65da79bf2fb91117d9cbb3f347767782dff0412173057587cc50b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105101, "uuid": "25b46eb5-b7be-43a1-b0de-0008de684899", "value": "T1C1F3CF2039D3C432E59735714477C7AC5AB6EF31DA670E8F2B58263E1F202D1967A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105101, "uuid": "e5423017-aa95-4f8e-a4ba-26ef1d234f3e", "value": "cd5c28f44b3cca36a31a3422b8479df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105101, "uuid": "6569600c-5ab8-4c3c-8ebb-412416decaa8", "value": "3072:BJLkAM9jKhQoJJNfrBNUxRec/m+t18fS7:BJLedKhQQN95c/mE1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629105101, "uuid": "7c2c0d4b-fb10-43ad-af4c-69ef361bcfa8", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629105101, "uuid": "ac0cc1b6-9f1f-475d-a50a-3468e8687cfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105101, "uuid": "01f33ee8-50ff-497b-940d-9d8a21e4c647", "value": "2d62eb793b2649d519f14e3a9447089d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e315e7ed-fed8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629149304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149304, "uuid": "fcc43db3-9e9a-4c24-8a99-83600b036261", "comment": "Malware payload (Dridex)", "value": "a0fcfe51b139d9a6d000325532fc5c93", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149304, "uuid": "18e54345-1150-48e7-87a1-e585b81c9109", "comment": "Malware payload (Dridex)", "value": "f19c5ec28c1823ae66dda4c42f60a0a322d571f8672b01548a3daffdb0aada5d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149304, "uuid": "4aec0ca5-9d49-40ed-b08a-bf2ae7859080", "comment": "Malware payload (Dridex)", "value": "df4bd35daa75b69b51747c3a6c7c3ce68f68e0c3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629149304, "uuid": "887af77b-1883-43af-a110-8c65ac6a9566", "comment": "Malware payload (Dridex)", "value": "51421a1d6ac6742660fb7a3d3288b4aebcb4a41b0e7311310f30151362dbc44e1998439a12accb9005557089334d8aca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149304, "uuid": "7fe67326-bacc-46a1-98e8-cb33623bc01f", "value": "T1FA34012A85B2E234E69660796C9E0FE523B99F6F05A02F27F5E1F49CEE04DC711510CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149304, "uuid": "602b636f-eb63-4add-8d7e-5db439045aa8", "value": "3072:SqAeN0RKSwCchO7e/1GrpdXx6sj848lblitKpRSnRXUhNFhy0RkURQ2Dqz9mCIkT:SeNSLcq+YXEssIKzQsFE+k8hqzrzlQDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629149304, "uuid": "4601995a-6adc-4b17-a616-7d283477be17", "value": 241523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629149304, "uuid": "c28c3e93-edce-4eca-8182-9aa820824d3e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629149304, "uuid": "35ffe29f-4825-4b3c-b62a-1def0c8ec0cc", "value": "taxve_398502496_20210816_54931825_44223925.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c1d098-fe89-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629115220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115220, "uuid": "613af660-1687-4dd0-9edb-762fb72a1e50", "comment": "Malware payload (RedLineStealer)", "value": "bcb5ce25375eea94a691f11146f5014e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115220, "uuid": "e2389e49-3328-4274-9f1c-b51039c17323", "comment": "Malware payload (RedLineStealer)", "value": "f224b56301de1b40dd9929e88dacc5f0519723570c822f8ed5971da3e2b88200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115220, "uuid": "b434ec50-97b8-4559-bedd-e2e7d24214ea", "comment": "Malware payload (RedLineStealer)", "value": "390833d4e888b8a67c39d1988b880ab2adefa6a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629115220, "uuid": "a8f8904c-54ae-4fd7-aede-08a3ffe038d1", "comment": "Malware payload (RedLineStealer)", "value": "2f94a1c503f3a231650d943a631f6de4ae66bde607da0d153e401d6106ae95899f4c7493ef650b06f8ff24604bd25770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115220, "uuid": "edb026f8-ef09-4b79-ab85-65a7751ebb46", "value": "T11354F12EB99FC871C384743544738B6C4D29AF01EAA3157717987B2A1F30FF1926AB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115220, "uuid": "e034eb43-39ae-4909-b016-c963474c742f", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115220, "uuid": "2aefb77b-2427-4dde-8b17-9d57365f46f1", "value": "6144:tLyPUeEbc7FSm8QJupM64r4ZXKbInVZTc/mfM:txLoF8Qoa6atK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629115220, "uuid": "b089f52c-90b0-4385-ac1e-bb34c3d02dab", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629115220, "uuid": "8249f1b2-245e-452a-8cb2-3f1b0565cd1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629115220, "uuid": "604194cf-1e73-44f1-b2af-9e6cb1fb2f1b", "value": "bcb5ce25375eea94a691f11146f5014e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa91d238-fe52-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629091656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629091656, "uuid": "02689d6f-344a-4586-b4aa-9e131da57956", "comment": "Malware payload (Formbook)", "value": "f0e566e1be01b2814c127f5b9af97ea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629091656, "uuid": "d283c7cf-7205-49d6-95d7-b97a0c3cb334", "comment": "Malware payload (Formbook)", "value": "f236d3c17eddd7b270030bd19051b43c8827af7925336611d0569e73c9b058b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629091656, "uuid": "98525c92-5c62-4184-94fa-a77703f511e1", "comment": "Malware payload (Formbook)", "value": "f60f94d24ed8658577d9b787f5aa51d290390dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629091656, "uuid": "a29f66e9-647f-4fa6-99fd-d92d85c2140f", "comment": "Malware payload (Formbook)", "value": "49fd2d4cfbc846447bb632c858ff64b9bb66bcca11a8317acbe538c5b025082ec8c6b411685efbf0d9647768d3d1ff78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629091656, "uuid": "0a6e614c-7c3c-402d-9796-7caa1feef331", "value": "T142A2D69032646B2BD9BEA7F8C0A7512013F2678B6073EE1D2DCE60DB7825F805551F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629091656, "uuid": "9e881da2-2a7a-4ddb-9d1c-0edd32999d10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629091656, "uuid": "a4d83868-01e8-41d6-ab91-97c4622d7448", "value": "384:T/UdJy7uXpn9O8T7As3sqNhYEVcU4l7TNvwXSMfK28lm3AJqriVd+CBYv21MD6ZW:jUdc7uXpn0WEs3sqNujNvwXBy0yyP3bZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629091656, "uuid": "f3eeae8e-9582-4783-806b-b06b8ad49228", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629091656, "uuid": "ef4c8b1e-dd63-4c69-9db4-d5dc2baa8b53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629091656, "uuid": "05953b71-25d4-4b3c-b43e-1d99646fcd09", "value": "RFQ5372837484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b212f3-fe66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Pony)", "timestamp": 1629100243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629100243, "uuid": "59e50ded-58d0-4405-9f72-993bcc873aca", "comment": "Malware payload (Pony)", "value": "30a1f73357e2088bdda8c95c2dda0eac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629100243, "uuid": "92ec938c-bb9c-4e67-86c7-a15c93c5c2c4", "comment": "Malware payload (Pony)", "value": "f2945753c6cedf8e7b8e8f4e04859591c3edf18c7652a00f9765ac99694cc874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629100243, "uuid": "b4088010-01d0-4082-ac66-6d5fee6353da", "comment": "Malware payload (Pony)", "value": "60f058765cde196581d5d20ec47fbb045a51cdbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629100243, "uuid": "69ee8a3b-b195-42a5-a31d-d72ba72deea4", "comment": "Malware payload (Pony)", "value": "e3739d5b3ac1056b42cc5b6d939af76c3f2f8286d82650cac677b33333e6e5037ffdedf2d272a6e15d40fa880339a8c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629100243, "uuid": "0d1f0dd4-0255-4793-b2b4-d9cb8c30c70c", "value": "T11593F803F481E0F1C0A22BB137C15761E7FD9E79BC7A8D5AEF4C48856DE268B6B12442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629100243, "uuid": "d9f33535-0621-4594-a809-ef441fd41ade", "value": "d777357137fc148884e24f774b09e366", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629100243, "uuid": "88421847-de13-46f0-a222-4e468df54eab", "value": "1536:JaeFDUyOAqTr2iz4U7XliQZS4hQz9518q7UdOkdATvVEwTkzmX:DR4sU7ViQZS1zgOkdUEwLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629100243, "uuid": "ad9068d4-5f9e-44d1-a7c4-5f1c28686fae", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629100243, "uuid": "f5b58652-b530-4450-921e-55ce297be4e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629100243, "uuid": "f7d9fd4b-cc35-45e7-b905-6e22e250e066", "value": "F2945753C6CEDF8E7B8E8F4E04859591C3EDF18C7652A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fe7df2-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629105020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105020, "uuid": "7f666eac-3e40-44c6-9293-4be22dfb126f", "comment": "Malware payload", "value": "b630ff102bf267c92e7e619647c0b81c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105020, "uuid": "a4e4c11d-395c-4159-a837-d576f9694cf1", "comment": "Malware payload", "value": "f3505a9a8ffdf1fd341bfa25c78207e1182ae018dfc7bc5d14514bd274b99edc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105020, "uuid": "e06ac173-6c7f-409d-bd7c-2770416555f8", "comment": "Malware payload", "value": "586a2f4e76be9f262681a88b169f93c2a0c112d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105020, "uuid": "6dd58869-57a3-43d8-b3d8-67f378f95b9a", "comment": "Malware payload", "value": "e1b5901482812083354d74b06ccb420c543174cc9a0a6c33b3675671b50f25d7a35469541e74fed384ea32413bf73c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105020, "uuid": "ca265a25-183e-4317-ad83-12d3abdf3107", "value": "T1EE953399C478E01AFCBF00762921C6757EE30E6291EC62144A47DE2F5CDEA05EE76933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105020, "uuid": "0113f7d4-6175-41f7-a3c4-472cf80ca94c", "value": "49152:Z7cNuGXqqcjPLk+SZYI7iWxqwrYZuNiVrypilYf20iGnZ:Z7cN9DcjjknZPxqDrsuYfHiGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629105020, "uuid": "6ca89bb6-3183-4fa3-9b5a-7bc8c76416ce", "value": 1880255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629105020, "uuid": "f2bbc4eb-7432-4415-a600-5e4e3b5f3712", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105020, "uuid": "fb07dd6e-1df5-4cf7-b3d7-e431e9e6c928", "value": "b630ff102bf267c92e7e619647c0b81c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7c1eb9-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629104791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104791, "uuid": "fdd592b2-06f3-410b-a4a8-36bc831bc0a1", "comment": "Malware payload (Smoke Loader)", "value": "156af0d6506284d584ee9bbc44da2d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104791, "uuid": "09780aa3-3ee5-4317-8506-5e68a410c10e", "comment": "Malware payload (Smoke Loader)", "value": "f3855d49ccbeeadc7d42439f83fa85f02f3383d42b7a8f2ad2d4e29d41f53441", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104791, "uuid": "e7336e59-3ca4-4c00-86e3-87347a01e61f", "comment": "Malware payload (Smoke Loader)", "value": "989e649faba5bd4e4d0895d75b1924e454a7d96e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104791, "uuid": "832da5eb-074a-4165-9b3f-8aaaf19eeabf", "comment": "Malware payload (Smoke Loader)", "value": "f3569157e73ec9f5c3d8a0655d38b715603af7b2b3e0c1499a873ea2fed508bcbd23efab8cbc31382094a97b3b4b89c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104791, "uuid": "bb3f21ca-ed6b-4bd6-8517-394a526970fa", "value": "T14904CF1DB48FC072C366713444B3EBAC1A69DF20DA53897B2788256F5F70EB05A663C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104791, "uuid": "ca998846-abaa-4d55-84b3-ed3710f8de81", "value": "675f985c31bb43cb925f7664d8fe06b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104791, "uuid": "f287bb2a-55f9-4a60-9fa6-59608444d772", "value": "3072:r+0LJHWDX7njbA2kg4hVmBNgrR1c/msZ7yz:jLirjcXDhsYc/m7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104791, "uuid": "6a85d18b-88d2-47df-b291-2c9984d7d31e", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104791, "uuid": "3e945fee-db8a-4184-8f3b-21c86c57c77e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104791, "uuid": "9697ad3b-c18b-46cd-8649-96497561c127", "value": "156af0d6506284d584ee9bbc44da2d61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5dca78-fe4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629088873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629088873, "uuid": "59e8e4d8-0207-4d71-a115-d8e0b8cdf81a", "comment": "Malware payload", "value": "46154f4385f7c1cbe1656518359f696c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629088873, "uuid": "130c41ba-5454-4fbe-8edc-6becfe48e5b2", "comment": "Malware payload", "value": "f4061f8c3a11c9a7fd8e0d1d213594cbdcbe85aa1ab02ac8c76f6897e1f9ef02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629088873, "uuid": "4010a729-69c1-4f28-b5b8-72a7fb0503ce", "comment": "Malware payload", "value": "6e34ee4cf5984ea7bed335b43de1fafeb3c86150", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629088873, "uuid": "b00c10df-141f-41f2-b2cb-2d97a7f9cc3c", "comment": "Malware payload", "value": "28232ec0502dffb611e5f3bfcf077606a1e1e780b2e3a2e858cdfe436cd23451a2d60e84b445a0e95326945ca364f598", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629088873, "uuid": "38cd8c5d-9ce5-44af-8f5c-f39dd1e3fb16", "value": "T1D854E02DB89FD0B1C3857D744437CBAC5979EB50E99304AB23482A6EEE70FF19261784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629088873, "uuid": "5c29eb3c-6e9d-4dde-bea3-d24cb2772838", "value": "894d0e2453b674d7fa4cc3ff89ddc063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629088873, "uuid": "c88c3680-4f54-49af-85ca-0d590dcc8cb8", "value": "6144:JKrLgPR3Uhzk/jI42gY3nIwXa4u8Rc/mMfKinT:JqkPeNk/jI42lnIH4uTbKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629088873, "uuid": "3bdd2a2e-a681-4742-808c-d7740e45e014", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629088873, "uuid": "e1e4b592-1dc4-415b-84c4-d41919b46129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629088873, "uuid": "688a72f2-108a-410c-827e-bcde30ff3c0c", "value": "46154f4385f7c1cbe1656518359f696c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f47e01-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629126008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126008, "uuid": "abeb6ac5-8bed-4044-97b2-8c55edd25998", "comment": "Malware payload (AgentTesla)", "value": "1ce3c7ed002e94792d675475ceb4cf48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126008, "uuid": "1ec15bc0-1161-4115-a727-24e45f1a864b", "comment": "Malware payload (AgentTesla)", "value": "f429388fb11aa0067f6e5927aaec48dd9d6c4c22893182961a7c6e5cc3648a79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126008, "uuid": "1a94f1d3-6034-45ef-b299-7ecf7de05b9a", "comment": "Malware payload (AgentTesla)", "value": "a42f0ccdd803cb7b4a8ea05e46e7c012d7fe06f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629126008, "uuid": "834dec66-9050-4627-a2ce-50884488345e", "comment": "Malware payload (AgentTesla)", "value": "1b530893121efdb193a49b57963a72e3287983a68c68d31f4e0d27d4cf2c4db73562d42a94e38a2d7a74a14d73c192eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126008, "uuid": "cc76c7ee-061f-467b-88e2-cc6fddce5f2c", "value": "T116155B9971FE75BEC897E57289551C20A612346FC32B8203901B29AEF93D857CF1D8F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126008, "uuid": "17d73a92-331a-4604-909c-67f3a1d7ccc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126008, "uuid": "3f76191e-a4c8-4ee3-8eaa-d9b5a0bda0e9", "value": "12288:UoMg9qlXpkRAkD0zsLrQmkc1DF2s6bogj4ydZlNBCfhWMN5fNnxKlfDb7b0wNZ9E:UoIoAg/LrQacs6boG4Wlv2W0NxKl7z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629126008, "uuid": "4fe4c764-f7f5-4098-8c49-41dadc121d78", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629126008, "uuid": "ca7fcdbb-c39c-4b87-9343-1e243afede61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629126008, "uuid": "8e91f9c8-2b3c-4177-bc89-a4cf4757950c", "value": "TRANSFER.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e569deb9-feb3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629133416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133416, "uuid": "8143d658-8ef3-4cd2-8e93-7070ac8271aa", "comment": "Malware payload (Dridex)", "value": "727ddadcfb432b1c5336338ffb56b451", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133416, "uuid": "ff7d3731-f63e-4d7e-9045-3ba304a55235", "comment": "Malware payload (Dridex)", "value": "f4366a50e2a86f65bccda978326b0ed301ad12bdb8e37ef928ddb992467d8a19", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133416, "uuid": "94ad6cab-0d21-4e86-bf0f-358a36689f03", "comment": "Malware payload (Dridex)", "value": "501a2bc865a4d41de9485fb2035c2d3e827082e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133416, "uuid": "25e29e32-dcf2-4af9-a3d7-ed2168bb5b8b", "comment": "Malware payload (Dridex)", "value": "a028ac7da81f1299cc1d92ba904d54f12b498fb8f99dd135ddbc7967c2c1a14a8c8eb506c12342f9ab55ba9094fe7972", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133416, "uuid": "d9a3da5c-7df0-4137-aed9-3b77f672535f", "value": "T18844F19669A3E59CFD4F6D7C8CDF19757F49CDAE06002A3F24E1A19CEAD03D01CA8489", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133416, "uuid": "418f80fd-2624-4f58-b6bc-62f30ca78a18", "value": "6144:SvtZbAPPimNA/kjoitkVig6XSm6SdLUSNhCsnQ2F7XYWbL6:wtZbAPDNAcMR6XSm6CLQsnN7TbL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133416, "uuid": "015cecd4-40b1-4cbf-9bdd-e07627055143", "value": 255808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133416, "uuid": "899f1e5f-a6cd-4138-9b70-7aa4f98d9fd1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133416, "uuid": "07db2b65-9a58-4fa4-9a7e-bbc63c113ef6", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_4_2132555285.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e528f3-fe7e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629110570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629110570, "uuid": "ee27ae08-a258-499c-8fcc-ac36ad13da95", "comment": "Malware payload (Cerberus)", "value": "eaa6ab2acfd38dec1f9b5763869d78b2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629110570, "uuid": "639574e1-8c28-4afc-8092-88567a2ac251", "comment": "Malware payload (Cerberus)", "value": "f65a0f2156a604271beee0c51564298667267260709d78e3a18e9de3baea4e22", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629110570, "uuid": "5d5b27e3-e101-498b-a56c-9518bd95fce2", "comment": "Malware payload (Cerberus)", "value": "30657697c8b7c67d8ef56c86086e3af375fc8e43", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629110570, "uuid": "2b00f415-c066-46fc-9780-fa77f9ea1c88", "comment": "Malware payload (Cerberus)", "value": "f18bbee0b53f188b83db90d83f4bbcbeeec61c6af026c6c0cf5ee61b779fadee82b4d84e4ffa3a572dfa3cb4988fd65c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629110570, "uuid": "28941b0c-e564-49e1-9052-98e6fa75686a", "value": "T1B3D30213A3A418EDD07F79300ECDA3561BB61B84BEE2A3D33D19424D9C966970F19E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629110570, "uuid": "9f127ae2-c272-4bcb-a8d0-9aff6a87b0f9", "value": "3072:t6HJtUzyvpyXaAHCGN0vuLuIQ2XzXcvsV:ti72uca0vN0vovQ2jsvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629110570, "uuid": "e51049f5-3bd5-40ca-9c5b-aa9bc71f5bdf", "value": 136623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629110570, "uuid": "07e3c03d-c003-4c9b-8f92-3f0f6a2f40c2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629110570, "uuid": "d72383d3-a654-4fd5-a5f6-621bda1b911c", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a612046-fed2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629146363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146363, "uuid": "6650f7b2-bb59-4c0c-bd16-756e57a30545", "comment": "Malware payload (Dridex)", "value": "0f876c50f26f4b51a8494917ca26c8c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146363, "uuid": "17b79f48-1554-467d-9b76-5121a4964ec8", "comment": "Malware payload (Dridex)", "value": "f798e0d1df1621b2336c292f6b6f58e391a3c6b15701ab907dfd231325fee04f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146363, "uuid": "e3a832ae-539a-467f-8898-aac3207ca215", "comment": "Malware payload (Dridex)", "value": "e314fca1c2e6ff3a7ba538c06add4a8d4bbedc87", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629146363, "uuid": "9bb54849-4b7e-4ac3-a6ba-5ce88e8209dc", "comment": "Malware payload (Dridex)", "value": "119ce6bc629f1954d1ef4580955737f803dadaccedead42fefb29f858187e78d3097d1c7596373994167ae6dea816f18", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146363, "uuid": "d3dfe814-981f-48ea-995e-0b4557f75710", "value": "T1B74401545653D68CFA9F7E3D8CDE04B06F8ACCED1600AABF22B0B35CDAD07994C59186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146363, "uuid": "7995ae92-c83e-4299-b0a3-d53e7a1c7fc9", "value": "6144:SztZbAPPimNA/kjoitkY1cQ0OIIxpEbE8AesoX:ytZbAPDNAcM+HkI4b/5sA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629146363, "uuid": "60bb7a29-09a5-4d74-9c95-613b1e651563", "value": 258818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629146363, "uuid": "6bd8abe0-a3a5-45ba-bff8-efff68f8749e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629146363, "uuid": "4439f091-4407-4db4-8099-c84ba0f130d2", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_2425415.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6961af-fe71-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629104836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104836, "uuid": "27464f78-d55c-4048-8abe-94fc3f269309", "comment": "Malware payload", "value": "7d3ea0140afd05d49c5b7d1d31edef59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104836, "uuid": "93a17dad-1137-4ab1-80b1-8fb07e7ac2af", "comment": "Malware payload", "value": "f7a78eb46802acb909a5b1dd916c597891fe010733f61d0a60b18e86a69213a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104836, "uuid": "c4ba6852-0f70-4004-9940-f5fde2874b32", "comment": "Malware payload", "value": "68f0e5f5250063d966c49cc935ea36842955aeb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629104836, "uuid": "ac7f3ff3-0914-408e-a689-3041b0150949", "comment": "Malware payload", "value": "834d10119d1a0600b41f4dc88ace1fcdf2f05981ad2c041b4457858ad30837901122cf23d0109b20ecd4b632821f04fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit CVE-2021-31956", "colour": "#278D99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104836, "uuid": "2b5e1c0a-951a-42ed-b280-85b9c828a3f8", "value": "T1DC347C5977A90CF8ED77813DCC529506E6B2B8160371DBBF03A0466B5F236909D3EB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104836, "uuid": "513dff21-d355-475b-b866-2b149b33a64e", "value": "6e2488ae21ff25743161736f560980cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104836, "uuid": "65222240-acb3-46c9-964f-a13032e55c33", "value": "6144:F7MaLp9GRkZrnF8y15iSi72oh8O52Kal:BMaCSzte2oD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629104836, "uuid": "280692c7-5697-4d92-9f66-187a709980b1", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629104836, "uuid": "8d025f5a-6ae1-4184-bc6c-964f3babc288", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629104836, "uuid": "45ae8c84-33e6-40d2-8aa8-5b355a7468e6", "value": "f7a78eb46802acb909a5b1dd916c597891fe010733f61d0a60b18e86a69213a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354c90a8-fec1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629139134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139134, "uuid": "39c2c4ea-0e69-4ffd-ab2c-c8416ac2cb42", "comment": "Malware payload (Dridex)", "value": "a72fc2c6d0a42b070a2974a2ac126b90", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139134, "uuid": "4f387497-7096-474e-87ee-8b917d6b6947", "comment": "Malware payload (Dridex)", "value": "f7d5faaf527162e4638350db7a5a79287af9e2a22d3409a75497695eee6e9e5f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139134, "uuid": "efb07dbf-fce7-47f5-8312-bd2de8ea84f4", "comment": "Malware payload (Dridex)", "value": "72dc19c3d6c19f3e1fb304f61bc97b9952b6d01c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139134, "uuid": "f7f72f9b-88ec-4119-8865-270b7cc4464e", "comment": "Malware payload (Dridex)", "value": "d59533a616b17b1fec41050af01935675aad573016e95a9f098c59e063f1995e48e8c66c2db4f5b58f1e8648cad608ac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139134, "uuid": "c668daa0-d487-4d97-9bf1-e762a57a5e46", "value": "T1264401646A5BF69CFE4F3C7C8CDE18B42B99DCBE090029AF22B0A94CD6D03D25D154D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139134, "uuid": "b07c0a8c-ca58-4bae-ab97-789254cfea75", "value": "6144:SPktZbAPPimNA/kjoitkLwo+Pb9z/wPTp5C5T2:MktZbAPDNAcMMo+T9STuT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629139134, "uuid": "fff02661-c5b6-48a5-a05c-571c3ee0b39d", "value": 256462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629139134, "uuid": "fca3f819-0236-4420-ac10-e786f8e1e736", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139134, "uuid": "3b56fcd4-221b-4b9a-ac19-b3faae55c7b9", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_6_54362298.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f60bed-fea6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629127860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127860, "uuid": "328ed98a-fae6-435d-af93-c9f9bf169a93", "comment": "Malware payload (NanoCore)", "value": "1c1b7f62e02378d4da1f9ab640b62a66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127860, "uuid": "d209d775-7c58-44a8-8d9f-5002282905e5", "comment": "Malware payload (NanoCore)", "value": "f978d5042c9856f428c69fbdfe2083ce3fd972b938b855e0fcd6e99431284791", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127860, "uuid": "12cedb21-be2e-4536-94f5-16e61e20d1fa", "comment": "Malware payload (NanoCore)", "value": "3b8167ffbbc50b25f53829c85b3d68baacca4c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629127860, "uuid": "3a31a87d-3e88-4df2-94db-a5341886482f", "comment": "Malware payload (NanoCore)", "value": "6d992bd5c752135c3ca12a42e2f2b10f97cd775113a0d388daf3de80ab6b73cc80ef5c567adcfa057f3444de12a8fac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127860, "uuid": "e7f62900-a516-4cc4-a002-2497a1d802ae", "value": "T1A9D47D66B501148EAA5CAF24E88E116E3A619FF12C78CD9FFF560FC7920B42474F616C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127860, "uuid": "f9a423ad-0ef6-4417-b3ed-bf93b9e57064", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127860, "uuid": "be2bcf8b-e7c7-41ed-ace6-31a203dedb47", "value": "12288:sbRP36Wz8CCeKnI7jNCcmE1qD23hBqPmP8f0HYp8lwVf9/wm:sbR/pzZT4r2qDKPqPNQL+9Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629127860, "uuid": "eb435aa9-bd95-4e57-9aa3-6a1677943f66", "value": 624496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629127860, "uuid": "a1282805-d702-455d-86d4-fe2fb1c0020a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629127860, "uuid": "f2fd6025-8040-4b6d-8e10-275863eba9e2", "value": "Skd~0938373883Tf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df28446b-feb4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629133835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133835, "uuid": "24124f89-c179-4c9a-8d6c-d420dbe3503c", "comment": "Malware payload (Dridex)", "value": "dfc836fb4e38375eb01187a5045b1600", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133835, "uuid": "c8ccf479-d22e-432d-bcfc-f1919d9f6c1a", "comment": "Malware payload (Dridex)", "value": "f9aa1cea6d7db3700c930b89cda4b60bb92a53eea24ad3db7319b44ab974a197", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133835, "uuid": "1bb132f7-a5ef-4d6b-9b38-5f3e1119c51a", "comment": "Malware payload (Dridex)", "value": "cc6141032ec6b287353047637b44d7b1ab3d0096", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133835, "uuid": "baece7ca-7ef8-45f8-aaa0-5a4250d71277", "comment": "Malware payload (Dridex)", "value": "833d481227ae3736781308a2153eed88d97d72d53259a8380b284cf551d72b2dde933a1436de066b3c70e177dfae9b57", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133835, "uuid": "0a6db0b4-1830-470b-947f-d812f2eaf23f", "value": "T1A854011419A3E98CFE8F5DBCCC9E1A74AF8ADCFD01002D7F28E4A94CEAD56D45C6444A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133835, "uuid": "9ed96912-52d4-4aba-a9cb-a1d78a31cf41", "value": "6144:SNtZbAPPimNA/kjoitkJ7ab6Arn+EwMhLipyRJ5LN3Q2i7aD:stZbAPDNAcMZMrn+V0LE2JFN3QV7aD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133835, "uuid": "7690e319-889c-4356-baea-d1a8d36ff310", "value": 300223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133835, "uuid": "a5819297-a5a7-4da2-9e0b-b227dd0ab259", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133835, "uuid": "2eb3277e-2502-418a-af46-a728c9363be4", "value": "_Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_3_077130.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3618f58b-fe73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629105634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105634, "uuid": "48a22687-54f6-4860-ac5e-77c9f19c3bc5", "comment": "Malware payload (Loki)", "value": "eb6143bbc3034da199802e561f5ea701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105634, "uuid": "08fe53e0-9c42-475b-9ad5-f6cb9e802166", "comment": "Malware payload (Loki)", "value": "f9dc8d66ab3eb2ecf3a55276d8389ca7b688d78cdad725fd762714e311efd02f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105634, "uuid": "4eb6cbbe-d24c-4b0e-be6f-af2b75de3701", "comment": "Malware payload (Loki)", "value": "c16d6d9c79e500a73dc33d764b22fb575d6bd474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629105634, "uuid": "c98b3b50-3956-4afd-9549-ddd3cf16c69c", "comment": "Malware payload (Loki)", "value": "2a0457940f65f0f4145b8c3d5edbe3991dbc6d5bf726c43f0730ae810b3c8e63e3ef6f225250ff4f38fd486be4b74241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105634, "uuid": "ba32633f-99d0-4255-8cc5-8e1364d190fd", "value": "T137F4BF7171AB8A96F10F8A742578BD5403B231B3F9C68939175A6146CFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105634, "uuid": "7024d973-87e3-424e-a050-77d4a3b84d79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105634, "uuid": "581d1eb0-d271-4e7a-8291-d844a7e9b374", "value": "12288:kKftcn1U5MePFzpZJXj/6bRhQOwyOYuvbbTCQJ95JOEPpBja:/ftc1UacJGbRhQOw/bbbTCs/HPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629105634, "uuid": "fe7f02b4-4d83-4564-9169-804216b766bf", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629105634, "uuid": "7eeffa90-cc93-4d6a-a84e-5b4f2f8cad01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629105634, "uuid": "202e16c8-2b39-4634-94ed-e457cce0819f", "value": "RFQ REF AMOCT132020-B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3b857e-fea9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629129055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129055, "uuid": "3896bccb-6f4c-4195-a11e-d76f8ce3b589", "comment": "Malware payload (Mirai)", "value": "92badbe1e2f03ad3727d02dc4d11a99d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129055, "uuid": "1a71e866-505e-4f44-8803-7c411305ab11", "comment": "Malware payload (Mirai)", "value": "fa214b880ef21ad9e2bfbaf1634ce775f6528d9b80580e2f6a06a1403bff6b2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129055, "uuid": "91f881d6-71f9-4632-a5e5-4f3d9e1a1fa2", "comment": "Malware payload (Mirai)", "value": "9d22e77df91e984478666851f9dd3443f355965c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629129055, "uuid": "b37de4a7-5854-470c-bfa3-c56e9e56391e", "comment": "Malware payload (Mirai)", "value": "6a42645eef6ef828e4a4c5b23c3cdb8ef47bec2bf78f47c4cf8cb629a320e4a3b047be5260171eecbf71248371854bec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129055, "uuid": "36afb780-2371-4b04-b0db-b5f98a95af86", "value": "T175539419BF610FBBEC5FDD3749A91B0125CC641A21993B3A7D34D818F31B61B1AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129055, "uuid": "08982b26-6559-4744-8045-558ddfa2009b", "value": "1536:k4BBdlwSEmcePAbHC3hYzHSJpSRIWWsLM:k1e8rIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629129055, "uuid": "08642b50-823d-4403-81c9-d77b2bc816b4", "value": 64320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629129055, "uuid": "9465c470-9dc5-4488-9c71-de8bd5d26625", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629129055, "uuid": "13ecbd23-c839-4372-8246-ec5ab372efd9", "value": "92badbe1e2f03ad3727d02dc4d11a99d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ede9ab1-fec4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629140438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140438, "uuid": "333c0c24-c8ae-42cd-b430-e738c9848c95", "comment": "Malware payload (Dridex)", "value": "6f2c5c1b5ffecf9fdad39c798c866aa5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140438, "uuid": "ede9ff1b-fc39-481a-8586-8eb9b5cce886", "comment": "Malware payload (Dridex)", "value": "fa7caa53e7421aa7a72ee09be195e980678022f0760f052d59621c435d965f81", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140438, "uuid": "4686894c-e540-4bcc-bc2f-242f26abe8cc", "comment": "Malware payload (Dridex)", "value": "89353397d2cffed80bf6463a4be0e36d29044198", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140438, "uuid": "13add5ee-ddc7-49c9-b5fd-f3e92a2acc9b", "comment": "Malware payload (Dridex)", "value": "093a375891c1dc3284935f3225fd10f66dc0e5eb27442626987e423ce80f2b932c19dad72684925e59ee022c3eda4e2d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140438, "uuid": "8c9b4a90-5e36-4e34-b8f7-b8c947439ada", "value": "T1F934011A48B7E055EBCB60388C9E0FD513759D3B62D16B03F2F6A29DBE09DD3225418B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140438, "uuid": "43d1dc8e-181c-4c11-b253-cbd840bd1be8", "value": "6144:SzNSLcq+YXEs2cd0N8IxJXCTUapETuKmc89uPxz:0PYXEsPd09xpCTUCET0gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629140438, "uuid": "745f96c1-82bf-4c3d-ad45-ecd8f45b0a38", "value": 242000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629140438, "uuid": "2d729a98-d62c-43db-96a9-bd2498ace770", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140438, "uuid": "b0aceee6-98a1-492e-b26d-5d89ad2bc878", "value": "taxve_77159525_20210816_332674_067880.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ebae00-fec2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629139806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139806, "uuid": "ae614e60-b596-4c5e-bf51-ed927698e4ea", "comment": "Malware payload (Dridex)", "value": "66cb590b49ddcba75e1ed4647ca3d5f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139806, "uuid": "e444d441-1ecb-40fb-9bac-af4660ac4ec1", "comment": "Malware payload (Dridex)", "value": "fc155e6d2cd54391de76ef0716b8b0f9714c22a689c202252ace59ab7bb3cf28", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139806, "uuid": "c0f11e98-e49b-4ea0-abd4-2d67a6f780b6", "comment": "Malware payload (Dridex)", "value": "d03c9995f6db092ab06de8b57617e43ec64857c2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629139806, "uuid": "dbe3210b-76c7-4b92-b9ca-132938c7003b", "comment": "Malware payload (Dridex)", "value": "2ad5fbb8784d1e57147f0722c164fcf51bd98b3db9b19eed8a33933d3a07b879ca0dc3fba0631188d046eafdb498961c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139806, "uuid": "f1669c65-220a-4858-b393-6402125d95d0", "value": "T1F534F1294876F159E99BA4388DDF5FEB17B28DAB50F01B26F8E0B20D9E09CD315501CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139806, "uuid": "e88bb01a-20f9-4de6-a54c-cd0cfc60ac81", "value": "6144:SyNSLcq+YXEsWMymW9Dg0mAd64miVGFoWfdxZJZvLbK:BPYXEsMq0m4+FowdxZjLbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629139806, "uuid": "6ae638ee-d251-4ee5-bba1-1eb798aa2845", "value": 242811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629139806, "uuid": "55cc9047-e751-4153-a02f-1f95c5906daa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629139806, "uuid": "ea0b039e-c86b-4b0e-9fe9-9e105118caec", "value": "taxve_39365_20210816_9688432_4824429.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3dc5f7b-feb2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629133011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133011, "uuid": "e8d63940-a264-445d-ab06-7c30be086caa", "comment": "Malware payload", "value": "b003f79fa3a027dab21a2f94d0094685", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133011, "uuid": "1e581c78-1626-4f0f-8f87-be2b590e2868", "comment": "Malware payload", "value": "fc2797af90e46163ee68d1392d88f2f0c83c8c65cfad8ec66c5bc408f62687d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133011, "uuid": "37d96afc-c052-462e-8c25-a92f6768e1f2", "comment": "Malware payload", "value": "4c46344eef99a93baac7127de0d28d2562961892", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629133011, "uuid": "6c899da3-86a6-4948-9977-4d738ee0e2a4", "comment": "Malware payload", "value": "f037f0b5e29dc2fe972c0f483ca281e09276d46e56c9113bba761d9534a952542d0bd1cd09673f8537e29b33f1b08e98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133011, "uuid": "4bbd1a17-dc60-4936-9866-b8d5ee36c652", "value": "T18AA30796F800EFB6F40BE67604D74B21B670BBE14A531622731739B6AE762D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133011, "uuid": "483c95ab-3279-4da6-a984-86e4c3a756f7", "value": "3072:oYLnaaaCC91a3yOAq3TfDSmdmuxVqDr78fz1e:oYLnaaaCCYyOjTuMmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629133011, "uuid": "5bd52b06-fa32-4380-8fea-1bcdc59702c4", "value": 99337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629133011, "uuid": "7f15a076-bac8-4615-9357-0a3365e5773a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629133011, "uuid": "67d592e0-540b-4a5f-aef6-1b321202d688", "value": "b003f79fa3a027dab21a2f94d0094685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3813987-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629114515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114515, "uuid": "cb4c610f-a759-4c6c-a841-b12afb95aa1e", "comment": "Malware payload (RaccoonStealer)", "value": "4266b679716ff4d74516f484d986d165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114515, "uuid": "a9c74976-9ab3-46d7-8e75-43f0c3a5167b", "comment": "Malware payload (RaccoonStealer)", "value": "fc2d4be12648dae97df783706ec9fea8396d3327428fa73b44e2968fbd7d3e8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114515, "uuid": "5230b2c3-6893-448b-b220-682d42e34b32", "comment": "Malware payload (RaccoonStealer)", "value": "3a88516fa9f338787a28bc1f06254dca2ef4b856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114515, "uuid": "bf116b61-94df-49dd-ba94-fe21260f88a3", "comment": "Malware payload (RaccoonStealer)", "value": "aaf274c78efd436d5dd2e423bd213751e197dde34d7b77a43b04dab3f7f6db56defa63edf8c43c8ed506a214efdd2ea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114515, "uuid": "301fd38c-1117-4a2b-8930-96ac810f3177", "value": "T10E04BE2DB99FD073D396343444B38BAC9A38EF61DA53057B2794296E5F30EB08366349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114515, "uuid": "7c2a3f69-816d-48ac-b545-02fe6b245ddc", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114515, "uuid": "bd1096b5-7fa9-43fc-a02f-d621fa609a85", "value": "3072:iELTWW/LnThGk5f3cf+BNRZRIc/m5UMZ7yk:vL1zTQkB3cqAc/m5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114515, "uuid": "23506456-5643-4dcb-a5c8-d83f1104d48a", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114515, "uuid": "5fcc484b-e4d1-4a8a-a5ff-ed95e2ccbc72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114515, "uuid": "113233c7-703e-4e06-a9d7-d4a3cac038aa", "value": "4266b679716ff4d74516f484d986d165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3af506-fec7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629141915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141915, "uuid": "9e346c71-8552-418a-843d-64f1ab6eb2d0", "comment": "Malware payload (Dridex)", "value": "95662fdaa94bb3dba17ab7b08131d155", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141915, "uuid": "f8855a65-1de3-402e-93ce-c7f6ddae8c4b", "comment": "Malware payload (Dridex)", "value": "fc438967531e781548dce860bd837983caad758db7bbdaee7995372a1520f7b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141915, "uuid": "19955e9f-a00f-47fe-bc40-8d6ea570bf89", "comment": "Malware payload (Dridex)", "value": "99d3783e0d18aa751004b5e2202b4c659f5a04ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629141915, "uuid": "2fa2d4af-fb76-469f-b289-e260dbc105ca", "comment": "Malware payload (Dridex)", "value": "1074bcfe442428c92ad2931fd42a242ab01ba08bf5ab0ced3514acd01077312cef6d4e67f18a14acf7f1e9e41237d440", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141915, "uuid": "169d44c5-35b5-4735-aa17-2fe3135456c9", "value": "T1933402168572F124EAEB54379CCA1FE91BB1CF5F01D0AB26E2D4E11DAE05EE371844CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141915, "uuid": "cea5f130-141d-4532-9e90-d5a0f61b44c5", "value": "6144:SXNSLcq+YXEs2XtEa44zp/T9mZUHQuWQK8eVIZLk:yPYXEsjrK9wu7K8eVMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629141915, "uuid": "e709dc27-ba22-4b90-8fcf-343f602ec18d", "value": 241042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629141915, "uuid": "0260c46a-54d5-47df-b124-e038b4ce7890", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629141915, "uuid": "5470774c-19b2-40e1-90e8-6409d3840ca0", "value": "taxve_55104_20210816_027365_257437.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a2d477-fec3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629140176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140176, "uuid": "9d53f16d-619d-4cbd-acf5-1ff9a4efea55", "comment": "Malware payload", "value": "2cd62d578abb738b28857caff42e6be5", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140176, "uuid": "77a078e6-9fb7-438b-ac86-b021e6fdbd87", "comment": "Malware payload", "value": "fcace88107dbbf5647443eb1d73f123f2907513d1c3aaaee31b73404bebd4024", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140176, "uuid": "b758cc73-17e0-4d44-b9b4-e603a24df98d", "comment": "Malware payload", "value": "71848b71afe4303b071eed52ae8c3d88d79126c4", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629140176, "uuid": "8ae88de8-5733-476c-9fbd-7d9161382eee", "comment": "Malware payload", "value": "dfeddcd3b898bf8a26a8806ef1d0503d2f1f2698607cad3b1142912f58ba42454ef832e5ebf683db5781a887b8588f0a", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140176, "uuid": "b0975691-ac2c-4b81-b4e5-bd1ee809af95", "value": "T1A9551241AC54755AEA82F73DF54B2FA2E1FB0C340B2847126B35F206603DDF9AAFA145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140176, "uuid": "2c928327-a616-4b52-9c76-8c6c6526d87b", "value": "24576:KM1ArtgkxPvANS6MY+oCt727SMPeD7f26Chy35WrsRwijBBIlKUn7qLyGVCi:KATkxPvANSlpi7SLD7f2P2M6HBIYj2Gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629140176, "uuid": "e72c1ef4-3e51-4e6b-93e3-7f261aca61a6", "value": 1293912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629140176, "uuid": "d6df025c-30d7-42d9-a289-8a3da7c6ad76", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629140176, "uuid": "8feddc7d-5297-4b0a-acd7-87bcc2fcda16", "value": "PO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfde948-fea2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1629125968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125968, "uuid": "fb25e75b-632f-4e4d-9e5e-aff8eac39020", "comment": "Malware payload (OskiStealer)", "value": "3c0aae14c733b8f3b5f15d3f066e343d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125968, "uuid": "b0745fe8-4296-41c8-b247-9c592b85dcdb", "comment": "Malware payload (OskiStealer)", "value": "fd16c60e634e807f6bbb7c3e6e12a4231b7b34851eb98d6da2f178b6125c536f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125968, "uuid": "ddab46a4-56c9-4801-8a81-1fbce89f48ca", "comment": "Malware payload (OskiStealer)", "value": "a75840830a4a95f779809f4d52ad7328de9e4c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629125968, "uuid": "60ffbe1e-c4d2-4b7b-9fc7-af83a8b3c42a", "comment": "Malware payload (OskiStealer)", "value": "15d38efa1265b28d94312b607c2784dc1cc3c447adb8f4850a712e5148890778975d143c1e91e0de67a3db4d580f2751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125968, "uuid": "9c27a052-8805-4536-ab39-25b642a426ce", "value": "T17835703C29FD263FC0A6D675CBE28C13B00168AF7121AD5594C7172E532AA5376C72BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125968, "uuid": "ff018191-43f9-4ad2-830a-5d195186bf39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125968, "uuid": "b81d3a76-a4b4-4304-8f0b-0a851cd5cf5d", "value": "12288:O/8XZuGwgtGb74uChgDCe83dHY3XJEkKBiy8CalBmNWab9UXvBJZQ63GvIZDgQ:O/g5g74nGDCJxWXSfBihmECSfBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629125968, "uuid": "83457bb0-c327-47bf-96c8-f0f10ff072fd", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629125968, "uuid": "fccbdb08-86e6-47b6-8da2-34c97801296a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629125968, "uuid": "4075ce05-5521-48ea-b565-c9e56bc0ebf3", "value": "Doc_PO-8122021-753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8734b79-feec-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629157903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157903, "uuid": "4db6e2ed-20b0-4c56-9e79-33e5b7fb65b4", "comment": "Malware payload", "value": "a59ca1678fc13f5d50ca9f90dbd61b47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157903, "uuid": "3f74a162-b32a-4b67-937e-74c9669b6750", "comment": "Malware payload", "value": "fd9f4433ebb0cd33826d9ea6cbc5996ad86d26771273018ce50599bbe64f8692", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157903, "uuid": "44743177-fbe0-471b-9c03-2475d44d23db", "comment": "Malware payload", "value": "b2f6749c78316c5d369e8d8bb72fe4f632166227", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629157903, "uuid": "8046824f-7b96-49c3-8533-ea88b3aff56c", "comment": "Malware payload", "value": "ea6d7bfd19630a80c2287d20a22ed00f2d203904272ce41f835512982b5f3bd196717b275a64dfce51300c7a627cfd5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157903, "uuid": "7d8e6606-ad1c-40ba-ba07-aab8d84f4c8c", "value": "T180F52202B3D69A36F9BE0A7490FA42110F747D562BF2C35D1EB0E84E0D716826CB275E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157903, "uuid": "4ff1b747-a82e-4ed0-a9b9-946efe2165f3", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157903, "uuid": "57b35116-e97f-403a-a8b7-5c4471414250", "value": "98304:uHBoeuP/2eD6Ycg7jPx3w/CanAi8LU0DeXs:moeuPP6D+y/X8XDec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629157903, "uuid": "eda7b3c8-5524-48a4-93bf-6400a6cd89eb", "value": 3532200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629157903, "uuid": "73c5a94d-025b-4900-bdb5-cbaf02fbe547", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629157903, "uuid": "2184e678-4a09-420b-b384-4e10884a288d", "value": "a59ca1678fc13f5d50ca9f90dbd61b47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53f1906-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629114518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114518, "uuid": "7d79ea37-bfc8-4941-836c-83fad066554f", "comment": "Malware payload (Smoke Loader)", "value": "51d84ec7f9fd6f9cc4ed1c491a6419df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114518, "uuid": "1299f70c-f5d7-4630-8984-87e138b1aef3", "comment": "Malware payload (Smoke Loader)", "value": "fdacbb575b9ae8cba7286e562abd4d3547089e0ea17b4885b3a4a738b83831fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114518, "uuid": "81521c4d-1844-4406-b754-68a37d8605bb", "comment": "Malware payload (Smoke Loader)", "value": "fa21e010d7e6d52484ace0722d6e20dbc2c964f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114518, "uuid": "068eeb37-78dd-4c61-b937-539232949154", "comment": "Malware payload (Smoke Loader)", "value": "33eddfac96387c0901c5da3bc1ec3b2f902a677286bc54b302df800c546738160ff35005cfe5794b22277b8894772a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114518, "uuid": "1df97bbf-a10d-4fbd-9487-7d3cb12e12cd", "value": "T19704BE2DB68FD472C391713040778BAC1E79EF22CE6709FB1B89296A5E30EB05676345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114518, "uuid": "97a5de5d-513d-4f82-a1f6-8f2a582c17aa", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114518, "uuid": "8caa6c15-9c74-4f43-bb7b-1141ff1f3288", "value": "3072:2ALDGYdrnDHefhc/WHqzjMBNxurRXc/mr/67Z7yq:2ALnhDEq+GjEexc/m2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114518, "uuid": "f5222a2c-5623-4855-9961-cf5b977aa60f", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114518, "uuid": "685972ce-26e8-4594-95b9-ff918b488579", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114518, "uuid": "ebb5051a-c58e-46b9-a1ac-8a2582d0c6c2", "value": "51d84ec7f9fd6f9cc4ed1c491a6419df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24e1183-feb9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629135934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135934, "uuid": "6321cb55-3dfd-4fff-b82f-b855a0e90280", "comment": "Malware payload (RemcosRAT)", "value": "2e11cb22fcff3e1fbf803fea30380e75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135934, "uuid": "86dcbe50-320c-4f78-a83b-bca36716675b", "comment": "Malware payload (RemcosRAT)", "value": "fe1291793c9992efdb89799f37f0cf50cb9ef51f3a10d97d20431a2e4fadae70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135934, "uuid": "38ed49e8-ee92-45b3-a65c-6f45cb1c0e24", "comment": "Malware payload (RemcosRAT)", "value": "f38c38f3e9d80b3b3855266c30a993e56ab61bca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135934, "uuid": "f1fd9d0e-de3a-428d-8ffb-f73695c4cdaa", "comment": "Malware payload (RemcosRAT)", "value": "2b3ea6eb6f201e524ced3c6e378fa2701e7604dbe91c8b72856171a018fb2650f406f56a70168b850ee326a4e3917a53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135934, "uuid": "8407dca2-9132-4e44-b9d8-1b7bd5ddb391", "value": "T1B2059E52E4A1C837D5533778DE1FA99A8C157F01183828823BE47C49CF37B923AB57A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135934, "uuid": "38df09ff-c8a2-4efc-9ba3-d64bd030dfe6", "value": "1abe4551dd4f8ef04deab38d0027e326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135934, "uuid": "cd983b7b-35cb-4549-bd85-67299b12f703", "value": "12288:WhxUck0fyI/Xv94r0umLKC+pvbIAsrxPz+o8wccO:WhGdkF4r0uvnDIFpP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629135934, "uuid": "93ade8fe-840a-408d-9d1f-c39d42c633e2", "value": 846850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629135934, "uuid": "0710c2f8-5dcd-4e8f-985f-4e67522cd91d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135934, "uuid": "6c9edb9d-740b-422d-934d-576831724446", "value": "2e11cb22fcff3e1fbf803fea30380e75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beebf5d1-feb9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629135929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135929, "uuid": "4aeb12a1-2a82-42e4-90b7-291ec9af7b58", "comment": "Malware payload", "value": "3244a92cbba0f5edcae4ea2f2f0d1b7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135929, "uuid": "36ec0127-937a-4e9e-8e93-0a6204239d95", "comment": "Malware payload", "value": "fe23294471a62757c45932f4c5f6196585cc44f3ce5d29649868fe49c691ffa2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135929, "uuid": "1b3cdce3-6427-4522-a80d-05b18d1b5d6a", "comment": "Malware payload", "value": "11ef969daac07a85b9c953464e7e925049731ba7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629135929, "uuid": "5926bfb9-c7e2-46b6-a000-c692859cdf69", "comment": "Malware payload", "value": "262e9ad97a70c8584bb0bf4fa2715a7c4d4c190e6c1cb820b009a4d63f31604ed6d667b689f3a3a48ca4c5b751554c3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135929, "uuid": "feedbcc3-b550-40f1-9c49-cc2981d3a8cb", "value": "T1F8058C02F393DC37C232173C9D2EA9A66C0AFF211A7071865ED93C958B7EA853671257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135929, "uuid": "c64ce9be-7fc9-434a-8b11-92853adf1936", "value": "1abe4551dd4f8ef04deab38d0027e326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135929, "uuid": "2abccdd0-ea55-4a8e-888d-87a64adbe69a", "value": "12288:WhxUck0fyI/Xv94r0umLKC+pvbIAsrxPT+o8wcr:WhGdkF4r0uvnDIFJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629135929, "uuid": "07a8e3e3-d135-4869-8ab9-609de99725b8", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629135929, "uuid": "e931acf9-db36-412c-9d5b-6fc2ec2d8e46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629135929, "uuid": "be3a4e4c-48a7-4773-b558-ddb2a0618ed0", "value": "3244a92cbba0f5edcae4ea2f2f0d1b7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503c77a6-fedc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629150775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150775, "uuid": "fb996bb2-e104-43e2-8c5a-beadc94d46ab", "comment": "Malware payload (Dridex)", "value": "971de17dae7221624c7c3d2b957bee86", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150775, "uuid": "0c483848-8ba0-4d37-b50f-ccddd3e643bb", "comment": "Malware payload (Dridex)", "value": "fe763d4a57f327579fc2bd587b676c45cdfb4b23226c26f3ac5dcf3dec013c2a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150775, "uuid": "81ddf285-ff46-49dc-8d97-26073ba945f4", "comment": "Malware payload (Dridex)", "value": "d6b5f95922f6010fd9e7da9533babb300fe8fa8d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629150775, "uuid": "e079c938-9714-4975-a077-cd2b04d268ae", "comment": "Malware payload (Dridex)", "value": "1b876585ed4cfc9a009decab21263e164f5e44de6b1717ccbe452adac2e163f89bed5dbb7b572fe4a43d5ddf4a7bffcc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150775, "uuid": "9fc4ca3d-3ca4-4a21-b1fc-f35c58ff802e", "value": "T1EE3402224862F224F28BA03D9D9F1FEA23758E5F12D0572AF4D5970CEF08DE3946558B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150775, "uuid": "4096fd85-c3d5-451f-9d03-f28a3c84b1a0", "value": "6144:S4NSLcq+YXEsTAV0TDPbrWHoS1PLPWsduZ19:bPYXEsTAIooSZPWj19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629150775, "uuid": "5498e8f5-53c0-4f92-85ef-747964262856", "value": 243782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629150775, "uuid": "e95d0c12-4e67-4436-9c83-c16b40d08336", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629150775, "uuid": "73d72325-226a-4f99-98b0-a9fd93fd8393", "value": "taxve_4887069_20210816_53089_7946157774.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd404bbd-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629114505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114505, "uuid": "ffd36236-31f4-444c-aa15-44821e178cfd", "comment": "Malware payload (TrickBot)", "value": "d2eabbe9fc0ce9411f8eb4334ecc05b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114505, "uuid": "52866503-3fad-4d07-9058-f0bc104ffb42", "comment": "Malware payload (TrickBot)", "value": "ff460f5b7a62a1fcd51e82bf43fc7b5264552c53e3924ffb771d7c8355a99ade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114505, "uuid": "67e96252-0804-4dd0-830f-8fd86299630e", "comment": "Malware payload (TrickBot)", "value": "3e9a424e135ead02da15eed8bbb925fa5a7ddffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114505, "uuid": "ab1a3b0d-1062-4cd3-8862-fc37e80f9a2b", "comment": "Malware payload (TrickBot)", "value": "4139d3b6c07ab8aaf97ecd74b3aa90a2263d5395a23fab6fe1e8838bdcf62cbfd341444fe2a7274e942d13462a353452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114505, "uuid": "c3ecf3df-c028-41ac-bdac-420beb4f2287", "value": "T187F49D0135B1AC76D5A111B30EE5A66D5AB4AFC8772149CB67D0BE0C6B72FC0CB36236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114505, "uuid": "8d809cea-c9cc-419e-ab50-38d1f17e40ca", "value": "878b3c97f2cf4cbb19fae7bf08b6bf6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114505, "uuid": "9ea95b84-b352-4532-a41c-fb1f4c0b53d7", "value": "12288:3zgiXyC0EB3NGJwI888888888888888888888H0u7Kd6jIq+5ZWZXdSisd:UiXyC0m3Kf888888888888888888888u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114505, "uuid": "e7551b17-0831-45e0-9ae3-29f4bb9ebb53", "value": 778289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114505, "uuid": "777705a1-b288-4e2b-abff-cf6ae2ce83a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114505, "uuid": "c85a7cd1-5e8d-41a7-bd0f-c0d0189fc4e4", "value": "d2eabbe9fc0ce9411f8eb4334ecc05b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28c2035-fe87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629114433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114433, "uuid": "a254b0f4-725e-4c45-9bd3-9b3021149d0b", "comment": "Malware payload (RedLineStealer)", "value": "61848c2af23b397079ba837c73351458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114433, "uuid": "e3d54982-92ad-446f-9c17-c393a39be472", "comment": "Malware payload (RedLineStealer)", "value": "ffee20e0c17936875243ac105258abcf77e70001a0e8adc80aedbc5cfa9a7660", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114433, "uuid": "8e04312a-75c6-4690-8a8b-ecc6e25b8eee", "comment": "Malware payload (RedLineStealer)", "value": "192cefc63caba42ec30f7568e74c98f17ecdf666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629114433, "uuid": "550a28cb-2751-454a-bb6e-8d0fe1610026", "comment": "Malware payload (RedLineStealer)", "value": "e23068230ddd94c8aaaa0f44494d199d60f4e698bba74e11e8a7f2e0d1d8824942f5e16f06d37f31dbb7825f41421655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114433, "uuid": "921cc187-3fe7-409e-b34f-827bfa19afb7", "value": "T1BE54F12E669FD832C7573130487387AC1A79AF10C653557B27992B6E6F30FF0922A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114433, "uuid": "3155e4b6-2673-494e-bc0a-259c50c59c87", "value": "a93d3aeb5048cb343bc92212709955c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114433, "uuid": "ea4d489d-1863-4ad4-b789-f1b1b6fb4342", "value": "6144:3LyPUeEx85CSrdNMO+j+56kRbJASdOQ/fzc/mLyIYz:3xL0rnMO+8nwSM7XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629114433, "uuid": "5ba50db3-dbcd-4c0f-8fc3-9c78c83bd2c6", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629114433, "uuid": "3df3ecc3-2264-4d27-bb65-415846785eb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629114433, "uuid": "82cea20d-2486-4221-9184-7deca3ea6d4e", "value": "61848c2af23b397079ba837c73351458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }